CVE-2020-11988
Server-side request forgery (SSRF) in Apache XmlGraphics Commons
Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.
- Record
CVE-2020-11988- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-20, CWE-918
- Updated
- 2026-11-02
CVE List No score
Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.
- Record
CVE-2020-11988- Updated
- 2026-11-02
EUVDEUVD-2022-0985 No score
Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.
- Record
EUVD-2022-0985- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fmj2-7wx8-qj4v
Server-side request forgery (SSRF) in Apache XmlGraphics Commons
Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
- Record
GHSA-fmj2-7wx8-qj4v- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-20, CWE-918
- Updated
- 2026-11-02
OSV
Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.
- Record
CVE-2020-11988- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-11988
Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.
- Record
DEBIAN-CVE-2020-11988- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
Show 9 moreShow less
OSVGHSA-fmj2-7wx8-qj4v
Server-side request forgery (SSRF) in Apache XmlGraphics Commons
Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
- Record
GHSA-fmj2-7wx8-qj4v- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-20, CWE-918
- Updated
- 2026-11-02
OSVOESA-2022-1649
xmlgraphics-commons security update
Apache XML Graphics Commons is a library that consists of several reusable components used by Apache Batik and Apache FOP. Many of these components can easily be used separately outside the domains of SVG and XSL-FO. You will find components such as a PDF library, an RTF library, Graphics2D implementations that let you generate PDF and PostScript files, and much more. The Apache™ XML Graphics Commons project is part of the Apache™ Software Foundation, which is a wider community of users and developers of open source projects.
Security Fix(es):
Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.(CVE-2020-11988)
- Record
OESA-2022-1649- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-11988
Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.
- Record
UBUNTU-CVE-2020-11988- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1779151610 No score
TuxCare security update for org.apache.xmlgraphics:xmlgraphics-commons (1 CVE)
TuxCare rebuilt org.apache.xmlgraphics:xmlgraphics-commons to address 1 CVE. Fixed in 2.1-tuxcare.1.
- Record
CLSA-2026-1779151610- Updated
- 2026-11-02
OSVCLSA-2026-1779151626 No score
TuxCare security update for org.apache.xmlgraphics:xmlgraphics-commons (1 CVE)
TuxCare rebuilt org.apache.xmlgraphics:xmlgraphics-commons to address 1 CVE. Fixed in 1.4-tuxcare.1.
- Record
CLSA-2026-1779151626- Updated
- 2026-11-02
OSVCLSA-2026-1780274964 No score
TuxCare security update for commons-digester:commons-digester (4 CVEs)
TuxCare rebuilt commons-digester:commons-digester to address 4 CVEs. Fixed in 2.1-tuxcare.1.
- Record
CLSA-2026-1780274964- Updated
- 2026-11-02
OSVMGASA-2021-0144 No score
Updated xmlgraphics-commons packages fix a security vulnerability
The Apache XML Graphics Commons library is vulnerable to SSRF via the XMPParser that allow an attacker to cause the underlying server to make arbitrary GET requests (CVE-2020-11988).
- Record
MGASA-2021-0144- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12403-1 No score
xmlgraphics-commons-2.6-3.1 on GA media
These are all security issues fixed in the xmlgraphics-commons-2.6-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12403-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3550-1 No score
Security update for xmlgraphics-commons
This update for xmlgraphics-commons fixes the following issues:
- Update to version 2.6
- CVE-2020-11988: Fixed a server-side request forgery caused by improper input validation by the XMPParser. (bsc#281607)
- Record
SUSE-SU-2022:3550-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.xmlgraphics:xmlgraphics-commonsMaven |
before 2.6 | 2.6 |
org.apache.xmlgraphics:xmlgraphics-commonsTuxCare:Maven |
2.1 up to 2.1-tuxcare.1 | 2.1-tuxcare.1 |
org.apache.xmlgraphics:xmlgraphics-commonsTuxCare:Maven |
1.4 up to 1.4-tuxcare.1 | 1.4-tuxcare.1 |
xmlgraphics-commonsDebian:12 |
before 2.4-2 | 2.4-2 |
xmlgraphics-commonsDebian:13 |
before 2.4-2 | 2.4-2 |
xmlgraphics-commonsDebian:14 |
before 2.4-2 | 2.4-2 |
org.apache.xmlgraphics:xmlgraphics-commonsMaven |
before 2.6, plus listed versions 1.11.21.31.3.11.4 Show 7 moreShow less1.52.02.0.12.12.22.32.4 |
2.6 |
xmlgraphics-commonsMageia:7 |
before 2.6-1.mga7 | 2.6-1.mga7 |
xmlgraphics-commonsMageia:8 |
before 2.6-1.mga8 | 2.6-1.mga8 |
xmlgraphics-commonsopenEuler:20.03-LTS-SP1 |
before 2.2-4.oe1 | 2.2-4.oe1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xmlgraphics-commonsopenEuler:20.03-LTS-SP3 |
before 2.2-4.oe1 | 2.2-4.oe1 |
xmlgraphics-commonsopenEuler:22.03-LTS |
before 2.2-4.oe2203 | 2.2-4.oe2203 |
xmlgraphics-commonsSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 2.6-3.3.1 | 2.6-3.3.1 |
xmlgraphics-commonsUbuntu:16.04:LTS |
All versions, plus listed versions 1.5-4ubuntu12.0.1-2ubuntu12.1-1ubuntu1 |
None known |
xmlgraphics-commonsUbuntu:18.04:LTS |
All versions, plus listed versions 2.2-1 |
None known |
xmlgraphics-commonsUbuntu:20.04:LTS |
All versions, plus listed versions 2.3-12.4-1 |
None known |
xmlgraphics-commonsUbuntu:22.04:LTS |
All versions, plus listed versions 2.4-22.4-32.6-1 |
None known |
xmlgraphics-commonsUbuntu:24.04:LTS |
All versions, plus listed versions 2.8-2 |
None known |
xmlgraphics-commonsUbuntu:25.10 |
All versions, plus listed versions 2.10-22.10-3 |
None known |
xmlgraphics-commonsUbuntu:26.10 |
All versions, plus listed versions 2.11-1 |
None known |
xmlgraphics-commonsUbuntu:26.04:LTS |
All versions, plus listed versions 2.10-32.11-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-11988 is a high vulnerability (CVSS 8.2) in Apache Xmlgraphics Commons, published February 24, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.65%, the 93rd percentile. Fixed in org.apache.xmlgraphics:xmlgraphics-commons 2.6.
References
xmlgraphics.apache.org/security.html
lists.apache.org/thread.html/r588d05a0790b40a0eb81088252e1e8c1efb99706631421f17038eb05%40%3Cdev.poi.apache.org%3E
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JP4XA56DA3BFNRBBLBXM6ZAI5RUVFA33
Show 22 moreShow less
oracle.com//security-alerts/cpujul2021.html
nvd.nist.gov/vuln/detail/CVE-2020-11988
github.com/apache/xmlgraphics-commons/commit/57393912eb87b994c7fed39ddf30fb778a275183
issues.apache.org/jira/browse/XGC-122
security-tracker.debian.org/tracker/CVE-2020-11988
advisories.mageia.org/MGASA-2021-0144.html
bugs.mageia.org/show_bug.cgi?id=28440
openwall.com/lists/oss-security/2021/02/24/1
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1649
suse.com/support/update/announcement/2022/suse-su-20223550-1
bugzilla.suse.com/1182754
ubuntu.com/security/CVE-2020-11988
cve.org/CVERecord?id=CVE-2020-11988