CVE-2022-38648

PDFTranscoder does not block external resources

5.3 MediumFix available

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

2.43%Up 1.5 points since Sep 23, 2022

What each source reports

NVD Score used 5.3

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

Record: CVE-2022-38648
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

CVE List No score

PDFTranscoder does not block external resources

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

Record: CVE-2022-38648
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2022-6702 No score

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

Record: EUVD-2022-6702
Updated: 2026-11-02

GitHub AdvisoriesGHSA-53jm-3hc9-fqqc 5.3

Apache Batik vulnerable to Server-Side Request Forgery

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik Bridge versions 1.14 and below.

Record: GHSA-53jm-3hc9-fqqc
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-38648 5.3

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

Record: DEBIAN-CVE-2022-38648
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-03

OSVGHSA-53jm-3hc9-fqqc 5.3

Apache Batik vulnerable to Server-Side Request Forgery

Record: GHSA-53jm-3hc9-fqqc
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

Show 9 moreShow less

OSVOESA-2023-1651 7.5

batik security update

Batik is an inline templating engine for CoffeeScript, inspired by CoffeeKup, that lets you write your template directly as a CoffeeScript function.

Security Fix(es):

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-38398)

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-38648)

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-40146)

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.

(CVE-2022-44729)

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

A malicious SVG can probe user profile / data and send it directly as parameter to a URL.

(CVE-2022-44730)

Record: OESA-2023-1651
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-38648 5.3

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

Record: UBUNTU-CVE-2022-38648
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVCLSA-2026-1778633124 No score

TuxCare security update for org.apache.xmlgraphics (10 CVEs)

TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.

Record: CLSA-2026-1778633124
Updated: 2026-11-02

OSVCLSA-2026-1784856219 No score

TuxCare security update for org.apache.xmlgraphics:batik-bridge (1 CVE)

TuxCare rebuilt org.apache.xmlgraphics:batik-bridge to address 1 CVE. Fixed in 1.8-tuxcare.3.

Record: CLSA-2026-1784856219
Updated: 2026-11-02

OSV No score

PDFTranscoder does not block external resources

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

Record: CVE-2022-38648
Weakness: CWE-918
Updated: 2026-11-02

OSVMGASA-2024-0068 No score

Updated batik packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. (CVE-2022-38398) Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. (CVE-2022-38648) Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. (CVE-2022-40146) A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. (CVE-2022-41704) A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. (CVE-2022-42890)

Record: MGASA-2024-0068
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12363-1 No score

xmlgraphics-batik-1.15-1.1 on GA media

These are all security issues fixed in the xmlgraphics-batik-1.15-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12363-1
Updated: 2026-11-02

OSVSUSE-SU-2024:0777-1 No score

Security update for xmlgraphics-batik

This update for xmlgraphics-batik fixes the following issues:

CVE-2017-5662: Fixed Apache Batik information disclosure vulnerability (bsc#1034675).
CVE-2019-17566: Fixed SSRF vulnerability (bsc#1172961).
CVE-2020-11987: Fixed Apache XML Graphics Batik SSRF vulnerability (bsc#1182748).
CVE-2022-38398: Fixed information disclosure vulnerability (bsc#1203674).
CVE-2022-38648: Fixed information disclosure vulnerability (bsc#1203673).
CVE-2022-40146: Fixed information disclosure vulnerability (bsc#1203672).
CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).
CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).
CVE-2022-44729: Fixed Server-Side Request Forgery.
CVE-2022-44730: Fixed Server-Side Request Forgery.

Upgrade to version 1.17.

Record: SUSE-SU-2024:0777-1
Updated: 2026-11-02

OSVUSN-6117-1 No score

batik vulnerabilities

It was discovered that Apache Batik incorrectly handled certain inputs. An attacker could possibly use this to perform a cross site request forgery attack. (CVE-2019-17566, CVE-2020-11987, CVE-2022-38398, CVE-2022-38648)

It was discovered that Apache Batik incorrectly handled Jar URLs in some situations. A remote attacker could use this issue to access files on the server. (CVE-2022-40146)

It was discovered that Apache Batik allowed running untrusted Java code from an SVG. An attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2022-41704, CVE-2022-42890)

Record: USN-6117-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.xmlgraphics:batik` Maven	before 1.15	1.15
`org.apache.xmlgraphics:batik-bridge` Maven	before 1.15	1.15
`org.apache.xmlgraphics:batik-anim` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-awt-util` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-bridge` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-codec` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-css` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-dom` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-ext` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-extension` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1

Show 48 moreShow less

Affected packages
Package	Affected	Fixed
`org.apache.xmlgraphics:batik-extensions` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-gui-util` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-gvt` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-js` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-parser` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-rasterizer` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-rasterizer-ext` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-script` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-slideshow` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-squiggle` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-squiggle-ext` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-svg-dom` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-svggen` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-svgpp` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-swing` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-transcoder` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-ttf2svg` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-util` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-xml` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-bridge` TuxCare:Maven	1.8 up to 1.8-tuxcare.3, plus listed versions 1.8-tuxcare.11.8-tuxcare.2	1.8-tuxcare.3
`batik` Debian:12	before 1.15+dfsg-1	1.15+dfsg-1
`batik` Debian:13	before 1.15+dfsg-1	1.15+dfsg-1
`batik` Debian:14	before 1.15+dfsg-1	1.15+dfsg-1
`batik` Debian:10 From an advisory covering 6 CVEs	before 1.10-2+deb10u3, plus listed versions 1.10-21.10-2+deb10u11.10-2+deb10u2	1.10-2+deb10u3
`batik` Debian:11 From an advisory covering 4 CVEs	before 1.12-4+deb11u3, plus listed versions 1.12-41.12-4+deb11u11.12-4+deb11u2	1.12-4+deb11u3
`org.apache.xmlgraphics:batik` Maven	before 1.15, plus listed versions 1.101.111.121.131.141.9.1	1.15
`org.apache.xmlgraphics:batik-bridge` Maven	before 1.15, plus listed versions 1.101.111.121.131.14 Show 5 moreShow less 1.6.11.71.81.91.9.1	1.15
`batik` Mageia:9 From an advisory covering 5 CVEs	before 1.14-4.1.mga9	1.14-4.1.mga9
`batik` openEuler:20.03-LTS-SP1 From an advisory covering 5 CVEs	before 1.17-1.oe1	1.17-1.oe1
`batik` openEuler:20.03-LTS-SP3 From an advisory covering 5 CVEs	before 1.17-1.oe1	1.17-1.oe1
`batik` openEuler:22.03-LTS From an advisory covering 5 CVEs	before 1.17-1.oe2203sp2	1.17-1.oe2203sp2
`batik` openEuler:22.03-LTS-SP1 From an advisory covering 5 CVEs	before 1.17-1.oe2203sp1	1.17-1.oe2203sp1
`batik` openEuler:22.03-LTS-SP2 From an advisory covering 5 CVEs	before 1.17-1.oe2203sp2	1.17-1.oe2203sp2
`xmlgraphics-batik` SUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 10 CVEs	before 1.17-2.7.1	1.17-2.7.1
`batik` Ubuntu:Pro:14.04:LTS	before 1.7.ubuntu-8ubuntu2.14.04.3+esm1, plus listed versions 1.7.ubuntu-8ubuntu21.7.ubuntu-8ubuntu2.14.04.11.7.ubuntu-8ubuntu2.14.04.21.7.ubuntu-8ubuntu2.14.04.3	1.7.ubuntu-8ubuntu2.14.04.3+esm1
`batik` Ubuntu:Pro:16.04:LTS	before 1.8-3ubuntu1+esm1, plus listed versions 1.7.ubuntu-8ubuntu31.8-31.8-3ubuntu1	1.8-3ubuntu1+esm1
`batik` Ubuntu:18.04:LTS	before 1.10-2~18.04.1, plus listed versions 1.9-31.10-2~18.04	1.10-2~18.04.1
`batik` Ubuntu:20.04:LTS	before 1.12-1ubuntu0.1, plus listed versions 1.10-21.12-1	1.12-1ubuntu0.1
`batik` Ubuntu:22.04:LTS	before 1.14-1ubuntu0.2, plus listed versions 1.12-41.14-1	1.14-1ubuntu0.2
`batik` Ubuntu:24.04:LTS	All versions, plus listed versions 1.16+dfsg-11.17+dfsg-1	None known
`batik` Ubuntu:25.10	All versions, plus listed versions 1.18+dfsg-2	None known
`batik` Ubuntu:26.10	All versions, plus listed versions 1.18+dfsg-2build11.19-2	None known
`batik` Ubuntu:26.04:LTS	All versions, plus listed versions 1.18+dfsg-21.18+dfsg-2build1	None known
`batik` Ubuntu:Pro:14.04:LTS From an advisory covering 7 CVEs	before 1.7.ubuntu-8ubuntu2.14.04.3+esm1, plus listed versions 1.7.ubuntu-8ubuntu21.7.ubuntu-8ubuntu2.14.04.11.7.ubuntu-8ubuntu2.14.04.21.7.ubuntu-8ubuntu2.14.04.3	1.7.ubuntu-8ubuntu2.14.04.3+esm1
`batik` Ubuntu:Pro:16.04:LTS From an advisory covering 7 CVEs	before 1.8-3ubuntu1+esm1, plus listed versions 1.7.ubuntu-8ubuntu31.8-31.8-3ubuntu1	1.8-3ubuntu1+esm1
`batik` Ubuntu:18.04:LTS From an advisory covering 7 CVEs	before 1.10-2~18.04.1, plus listed versions 1.9-31.10-2~18.04	1.10-2~18.04.1
`batik` Ubuntu:20.04:LTS From an advisory covering 7 CVEs	before 1.12-1ubuntu0.1, plus listed versions 1.10-21.12-1	1.12-1ubuntu0.1
`batik` Ubuntu:22.04:LTS From an advisory covering 7 CVEs	before 1.14-1ubuntu0.2, plus listed versions 1.12-41.14-1	1.14-1ubuntu0.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-38648 is a medium vulnerability (CVSS 5.3) in Apache Batik, published September 22, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.43%, the 84th percentile. Fixed in org.apache.xmlgraphics:batik 1.15.

References

Show 46 moreShow less