GHSA-25gw-4pcc-45cf · Severity: critical · Ecosystem: maven — Deserialization of Untrusted Data in Apache Batik
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
Conclusion & alert: CVE-2018-8013 is rated High Risk (66.5/100): CVSS Critical severity, with medium exploitation likelihood (EPSS 1.23%). Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-04-13 | 1.67% | 1.23% | -0.43% |
| 2 | 2026-03-22 | 1.33% | 1.67% | +0.34% |
| 3 | 2026-03-04 | — | 1.33% | — |
Full EPSS history (50 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.8 | 3.0 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
| 7.5 | 2.0 | HIGH |
|
10.0 | 6.4 | [email protected] |
GHSA-25gw-4pcc-45cf · Severity: critical · Ecosystem: maven — Deserialization of Untrusted Data in Apache Batik
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2018-8013 not yet assigned priority: Debian including 1 source packages (batik), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2018-8013 |
gentoo
|
normal | CVE-2018-8013: 1 GLSA(s) (202401-11), 1 atom(s) (dev-java/batik); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2018-8013 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2018-8013 |
suse
|
low | — | https://www.suse.com/security/cve/CVE-2018-8013/ |
ubuntu
|
medium | CVE-2018-8013 medium priority: Ubuntu including 1 source packages (batik), 20 status rows across 20 suites (artful, bionic, cosmic, disco, eoan, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): not-affected 16, released 2, ignored 1, needed 1. | https://ubuntu.com/security/CVE-2018-8013 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| apache | batik | >= 1.0, < 1.10 | cpe:2.3:a:apache:batik:*:*:*:*:*:*:*:* |
| debian | debian_linux | 7.0 | cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
| debian | debian_linux | 8.0 | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| debian | debian_linux | 9.0 | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| canonical | ubuntu_linux | 14.04 | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* |
| oracle | business_intelligence | 11.1.1.7.0 | cpe:2.3:a:oracle:business_intelligence:11.1.1.7.0:*:*:*:enterprise:*:*:* |
| oracle | business_intelligence | 11.1.1.9.0 | cpe:2.3:a:oracle:business_intelligence:11.1.1.9.0:*:*:*:enterprise:*:*:* |
| oracle | business_intelligence | 12.2.1.3.0 | cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* |
| oracle | business_intelligence | 12.2.1.4.0 | cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* |
| oracle | communications_diameter_signaling_router | < 8.3 | cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* |
| oracle | communications_metasolv_solution | 6.3.0 | cpe:2.3:a:oracle:communications_metasolv_solution:6.3.0:*:*:*:*:*:*:* |
| oracle | communications_webrtc_session_controller | < 7.2 | cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:* |
| oracle | data_integrator | 12.2.1.3.0 | cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:* |
| oracle | enterprise_repository | 11.1.1.7.0 | cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:* |
| oracle | enterprise_repository | 12.1.3.0.0 | cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:* |
| oracle | financial_services_analytical_applications_infrastructure | >= 7.3.3.0.0, <= 7.3.3.0.2 | cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* |
| oracle | financial_services_analytical_applications_infrastructure | >= 8.0.0.0.0, <= 8.0.7.1.0 | cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* |
| oracle | fusion_middleware_mapviewer | 12.2.1.2 | cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.2:*:*:*:*:*:*:* |
| oracle | fusion_middleware_mapviewer | 12.2.1.3 | cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3:*:*:*:*:*:*:* |
| oracle | instantis_enterprisetrack | 17.1 | cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* |
| oracle | instantis_enterprisetrack | 17.2 | cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* |
| oracle | instantis_enterprisetrack | 17.3 | cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* |
| oracle | insurance_calculation_engine | 10.1.1 | cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1:*:*:*:*:*:*:* |
| oracle | insurance_calculation_engine | 10.2.1 | cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1:*:*:*:*:*:*:* |
| oracle | insurance_policy_administration_j2ee | 10.0 | cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.0:*:*:*:*:*:*:* |
| oracle | insurance_policy_administration_j2ee | 10.2 | cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2:*:*:*:*:*:*:* |
| oracle | jd_edwards_enterpriseone_tools | 9.2 | cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* |
| oracle | retail_back_office | 13.3 | cpe:2.3:a:oracle:retail_back_office:13.3:*:*:*:*:*:*:* |
| oracle | retail_back_office | 13.4 | cpe:2.3:a:oracle:retail_back_office:13.4:*:*:*:*:*:*:* |
| oracle | retail_back_office | 14 | cpe:2.3:a:oracle:retail_back_office:14:*:*:*:*:*:*:* |
| oracle | retail_back_office | 14.1 | cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* |
| oracle | retail_central_office | 14.1 | cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:* |
| oracle | retail_integration_bus | 17.0 | cpe:2.3:a:oracle:retail_integration_bus:17.0:*:*:*:*:*:*:* |
| oracle | retail_order_broker | 5.1 | cpe:2.3:a:oracle:retail_order_broker:5.1:*:*:*:*:*:*:* |
| oracle | retail_order_broker | 5.2 | cpe:2.3:a:oracle:retail_order_broker:5.2:*:*:*:*:*:*:* |
| oracle | retail_order_broker | 15.0 | cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* |
| oracle | retail_order_broker | 16.0 | cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:* |
| oracle | retail_point-of-service | 13.4 | cpe:2.3:a:oracle:retail_point-of-service:13.4:*:*:*:*:*:*:* |
| oracle | retail_point-of-service | 14.0 | cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:* |
| oracle | retail_point-of-service | 14.1 | cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:* |
| oracle | retail_returns_management | 14.1 | cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* |