CVE-2022-40146

Jar url should be blocked by DefaultScriptSecurity

7.5 HighPublic exploitFix available

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

7.43%Up 6.5 points since Sep 23, 2022

What each source reports

NVD Score used 7.5

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Record: CVE-2022-40146
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

CVE List No score

Jar url should be blocked by DefaultScriptSecurity

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Record: CVE-2022-40146
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2022-6834 No score

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Record: EUVD-2022-6834
Updated: 2026-11-02

GitHub AdvisoriesGHSA-h4qg-p7r2-cpg3 7.5

Apache Batik vulnerable to Server-Side Request Forgery

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Record: GHSA-h4qg-p7r2-cpg3
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-40146 7.5

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Record: DEBIAN-CVE-2022-40146
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

OSVGHSA-h4qg-p7r2-cpg3 7.5

Apache Batik vulnerable to Server-Side Request Forgery

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Record: GHSA-h4qg-p7r2-cpg3
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

Show 8 moreShow less

OSVOESA-2023-1651 7.5

batik security update

Batik is an inline templating engine for CoffeeScript, inspired by CoffeeKup, that lets you write your template directly as a CoffeeScript function.

Security Fix(es):

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-38398)

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-38648)

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-40146)

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.

(CVE-2022-44729)

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

A malicious SVG can probe user profile / data and send it directly as parameter to a URL.

(CVE-2022-44730)

Record: OESA-2023-1651
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-40146 7.5

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Record: UBUNTU-CVE-2022-40146
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVCLSA-2026-1778633124 No score

TuxCare security update for org.apache.xmlgraphics (10 CVEs)

TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.

Record: CLSA-2026-1778633124
Updated: 2026-11-02

OSV No score

Jar url should be blocked by DefaultScriptSecurity

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Record: CVE-2022-40146
Weakness: CWE-918
Updated: 2026-11-02

OSVMGASA-2024-0068 No score

Updated batik packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. (CVE-2022-38398) Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. (CVE-2022-38648) Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. (CVE-2022-40146) A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. (CVE-2022-41704) A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. (CVE-2022-42890)

Record: MGASA-2024-0068
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12363-1 No score

xmlgraphics-batik-1.15-1.1 on GA media

These are all security issues fixed in the xmlgraphics-batik-1.15-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12363-1
Updated: 2026-11-02

OSVSUSE-SU-2024:0777-1 No score

Security update for xmlgraphics-batik

This update for xmlgraphics-batik fixes the following issues:

CVE-2017-5662: Fixed Apache Batik information disclosure vulnerability (bsc#1034675).
CVE-2019-17566: Fixed SSRF vulnerability (bsc#1172961).
CVE-2020-11987: Fixed Apache XML Graphics Batik SSRF vulnerability (bsc#1182748).
CVE-2022-38398: Fixed information disclosure vulnerability (bsc#1203674).
CVE-2022-38648: Fixed information disclosure vulnerability (bsc#1203673).
CVE-2022-40146: Fixed information disclosure vulnerability (bsc#1203672).
CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).
CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).
CVE-2022-44729: Fixed Server-Side Request Forgery.
CVE-2022-44730: Fixed Server-Side Request Forgery.

Upgrade to version 1.17.

Record: SUSE-SU-2024:0777-1
Updated: 2026-11-02

OSVUSN-6117-1 No score

batik vulnerabilities

It was discovered that Apache Batik incorrectly handled certain inputs. An attacker could possibly use this to perform a cross site request forgery attack. (CVE-2019-17566, CVE-2020-11987, CVE-2022-38398, CVE-2022-38648)

It was discovered that Apache Batik incorrectly handled Jar URLs in some situations. A remote attacker could use this issue to access files on the server. (CVE-2022-40146)

It was discovered that Apache Batik allowed running untrusted Java code from an SVG. An attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2022-41704, CVE-2022-42890)

Record: USN-6117-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.xmlgraphics:batik` Maven	1.0 up to 1.15	1.15
`org.apache.xmlgraphics:batik-anim` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-awt-util` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-bridge` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-codec` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-css` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-dom` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-ext` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-extension` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-extensions` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1

Show 45 moreShow less

Affected packages
Package	Affected	Fixed
`org.apache.xmlgraphics:batik-gui-util` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-gvt` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-js` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-parser` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-rasterizer` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-rasterizer-ext` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-script` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-slideshow` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-squiggle` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-squiggle-ext` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-svg-dom` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-svggen` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-svgpp` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-swing` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-transcoder` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-ttf2svg` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-util` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`org.apache.xmlgraphics:batik-xml` TuxCare:Maven From an advisory covering 10 CVEs	1.7 up to 1.7-tuxcare.1	1.7-tuxcare.1
`batik` Debian:12	before 1.15+dfsg-1	1.15+dfsg-1
`batik` Debian:13	before 1.15+dfsg-1	1.15+dfsg-1
`batik` Debian:14	before 1.15+dfsg-1	1.15+dfsg-1
`batik` Debian:10 From an advisory covering 6 CVEs	before 1.10-2+deb10u3, plus listed versions 1.10-21.10-2+deb10u11.10-2+deb10u2	1.10-2+deb10u3
`batik` Debian:11 From an advisory covering 4 CVEs	before 1.12-4+deb11u3, plus listed versions 1.12-41.12-4+deb11u11.12-4+deb11u2	1.12-4+deb11u3
`org.apache.xmlgraphics:batik` Maven	1.0 up to 1.15, plus listed versions 1.101.111.121.131.141.9.1	1.15
`batik` Mageia:9 From an advisory covering 5 CVEs	before 1.14-4.1.mga9	1.14-4.1.mga9
`batik` openEuler:20.03-LTS-SP1 From an advisory covering 5 CVEs	before 1.17-1.oe1	1.17-1.oe1
`batik` openEuler:20.03-LTS-SP3 From an advisory covering 5 CVEs	before 1.17-1.oe1	1.17-1.oe1
`batik` openEuler:22.03-LTS From an advisory covering 5 CVEs	before 1.17-1.oe2203sp2	1.17-1.oe2203sp2
`batik` openEuler:22.03-LTS-SP1 From an advisory covering 5 CVEs	before 1.17-1.oe2203sp1	1.17-1.oe2203sp1
`batik` openEuler:22.03-LTS-SP2 From an advisory covering 5 CVEs	before 1.17-1.oe2203sp2	1.17-1.oe2203sp2
`xmlgraphics-batik` SUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 10 CVEs	before 1.17-2.7.1	1.17-2.7.1
`batik` Ubuntu:Pro:14.04:LTS	before 1.7.ubuntu-8ubuntu2.14.04.3+esm1, plus listed versions 1.7.ubuntu-8ubuntu21.7.ubuntu-8ubuntu2.14.04.11.7.ubuntu-8ubuntu2.14.04.21.7.ubuntu-8ubuntu2.14.04.3	1.7.ubuntu-8ubuntu2.14.04.3+esm1
`batik` Ubuntu:Pro:16.04:LTS	before 1.8-3ubuntu1+esm1, plus listed versions 1.7.ubuntu-8ubuntu31.8-31.8-3ubuntu1	1.8-3ubuntu1+esm1
`batik` Ubuntu:18.04:LTS	before 1.10-2~18.04.1, plus listed versions 1.9-31.10-2~18.04	1.10-2~18.04.1
`batik` Ubuntu:20.04:LTS	before 1.12-1ubuntu0.1, plus listed versions 1.10-21.12-1	1.12-1ubuntu0.1
`batik` Ubuntu:22.04:LTS	before 1.14-1ubuntu0.2, plus listed versions 1.12-41.14-1	1.14-1ubuntu0.2
`batik` Ubuntu:24.04:LTS	All versions, plus listed versions 1.16+dfsg-11.17+dfsg-1	None known
`batik` Ubuntu:25.10	All versions, plus listed versions 1.18+dfsg-2	None known
`batik` Ubuntu:26.10	All versions, plus listed versions 1.18+dfsg-2build11.19-2	None known
`batik` Ubuntu:26.04:LTS	All versions, plus listed versions 1.18+dfsg-21.18+dfsg-2build1	None known
`batik` Ubuntu:Pro:14.04:LTS From an advisory covering 7 CVEs	before 1.7.ubuntu-8ubuntu2.14.04.3+esm1, plus listed versions 1.7.ubuntu-8ubuntu21.7.ubuntu-8ubuntu2.14.04.11.7.ubuntu-8ubuntu2.14.04.21.7.ubuntu-8ubuntu2.14.04.3	1.7.ubuntu-8ubuntu2.14.04.3+esm1
`batik` Ubuntu:Pro:16.04:LTS From an advisory covering 7 CVEs	before 1.8-3ubuntu1+esm1, plus listed versions 1.7.ubuntu-8ubuntu31.8-31.8-3ubuntu1	1.8-3ubuntu1+esm1
`batik` Ubuntu:18.04:LTS From an advisory covering 7 CVEs	before 1.10-2~18.04.1, plus listed versions 1.9-31.10-2~18.04	1.10-2~18.04.1
`batik` Ubuntu:20.04:LTS From an advisory covering 7 CVEs	before 1.12-1ubuntu0.1, plus listed versions 1.10-21.12-1	1.12-1ubuntu0.1
`batik` Ubuntu:22.04:LTS From an advisory covering 7 CVEs	before 1.14-1ubuntu0.2, plus listed versions 1.12-41.14-1	1.14-1ubuntu0.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	cckuailong/CVE-2022-40146_Exploit_Jar	2022-11-01
PoC in GitHub	soulfoodisgood/CVE-2022-40146	2024-07-30

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-40146 is a high vulnerability (CVSS 7.5) in Apache Batik, published September 22, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.43%, the 94th percentile. Fixed in org.apache.xmlgraphics:batik 1.15.

References

Show 45 moreShow less