A Server-Side Request Forgery (SSRF) vulnerability exists in Apache XML Graphics Batik through version 1.19. The issue involves the SVG color-profile xml:base attribute bypassing Batik's external resource same-origin checks. This vulnerability is fixed in version 1.20.