CVE-2015-0250
batik: XML External Entity (XXE) injection in SVG parsing
Severity
ModerateRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · July 25, 2012
Updated · March 5, 2026
Description
It was found that batik was vulnerable to XML External Entity attacks when parsing SVG files. A remote attacker able to send malicious SVG content to the affected server could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 5.8AV:N/AC:M/Au:N/C:P/I:N/A:P
CWE-611 · Improper Restriction of XML External Entity Reference