GHSA-qwgx-59jw-qfg9 · Severity: high · Ecosystem: maven — Improper Restriction of XML External Entity Reference in Apache Batik
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
Conclusion & alert: CVE-2017-5662 is rated Moderate Risk (58.6/100): CVSS High severity, with medium exploitation likelihood (EPSS 1.43%). Core evidence: EPSS rose +1.08% over the last day, indicating growing attacker interest. Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-05-30 | 0.36% | 1.43% | +1.08% |
| 2 | 2026-05-17 | 0.28% | 0.36% | +0.07% |
| 3 | 2026-02-11 | — | 0.28% | — |
Full EPSS history (12 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.3 | 3.0 | HIGH |
|
2.1 | 5.2 | [email protected] |
| 7.9 | 2.0 | HIGH |
|
6.8 | 9.2 | [email protected] |
GHSA-qwgx-59jw-qfg9 · Severity: high · Ecosystem: maven — Improper Restriction of XML External Entity Reference in Apache Batik
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2017-5662 not yet assigned priority: Debian including 1 source packages (batik), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2017-5662 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2017-5662 |
suse
|
high | CVE-2017-5662 severity important: SUSE including 3 source package names (xmlgraphics-batik, xmlgraphics-batik-1.17-2.7.1, xmlgraphics-batik-css), 21 product×package rows across 14 product lines (SUSE CaaS Platform 4.5, SUSE Enterprise Storage 7, … (14 product lines)): Known Not Affected 20, Fixed 1. | https://www.suse.com/security/cve/CVE-2017-5662/ |
ubuntu
|
medium | CVE-2017-5662 medium priority: Ubuntu including 1 source packages (batik), 23 status rows across 23 suites (artful, bionic, cosmic, disco, eoan, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, precise, questing, trusty, upstream, xenial, yakkety, zesty): not-affected 16, ignored 4, released 2, needed 1. | https://ubuntu.com/security/CVE-2017-5662 |