In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the cla

Summary

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

Timeline

1. May 24, 2018, 4:00 PM UTCCVE published
2. Sep 16, 2024, 11:16 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache Batik

  1.0 - 1.9.1

• org.apache.xmlgraphics:batikMaven

  From 1.0 · fixed in 1.10

References 17