CVE-2018-8013

9.8 criticalEPSS 19%

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 19% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2018-05-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:batik
canonical:ubuntu_linux
debian:debian_linux
oracle:business_intelligence
oracle:communications_diameter_signaling_router
oracle:communications_metasolv_solution
oracle:communications_webrtc_session_controller
oracle:data_integrator
oracle:enterprise_repository
oracle:financial_services_analytical_applications_infrastructure
oracle:fusion_middleware_mapviewer
oracle:instantis_enterprisetrack
oracle:insurance_calculation_engine
oracle:insurance_policy_administration_j2ee
oracle:jd_edwards_enterpriseone_tools
oracle:retail_back_office
oracle:retail_central_office
oracle:retail_integration_bus
oracle:retail_order_broker
oracle:retail_point-of-service
oracle:retail_returns_management

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-25gw-4pcc-45cf	Maven	org.apache.xmlgraphics:batik	>=1.0 <1.10	1.10

References

Check your stack JSON