CVE-2022-44729
Apache XML Graphics Batik: Information disclosure vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
- Record
CVE-2022-44729- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-918
- Updated
- 2026-11-02
CVE List No score
Apache XML Graphics Batik: Information disclosure vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
- Record
CVE-2022-44729- Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2023-2297 No score
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
- Record
EUVD-2023-2297- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gq5f-xv48-2365
Apache XML Graphics Batik Server-Side Request Forgery vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
- Record
GHSA-gq5f-xv48-2365- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
- Record
CVE-2022-44729- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-44729
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
- Record
DEBIAN-CVE-2022-44729- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-03
Show 9 moreShow less
OSVGHSA-gq5f-xv48-2365
Apache XML Graphics Batik Server-Side Request Forgery vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
- Record
GHSA-gq5f-xv48-2365- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVOESA-2023-1651
batik security update
Batik is an inline templating engine for CoffeeScript, inspired by CoffeeKup, that lets you write your template directly as a CoffeeScript function.
Security Fix(es):
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-38398)
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-38648)
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-40146)
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
(CVE-2022-44729)
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
A malicious SVG can probe user profile / data and send it directly as parameter to a URL.
(CVE-2022-44730)
- Record
OESA-2023-1651- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-44729
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
- Record
UBUNTU-CVE-2022-44729- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1778633124 No score
TuxCare security update for org.apache.xmlgraphics (10 CVEs)
TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.
- Record
CLSA-2026-1778633124- Updated
- 2026-11-02
OSVCLSA-2026-1780966324 No score
TuxCare security update for org.apache.xmlgraphics (1 CVE)
TuxCare rebuilt 2 org.apache.xmlgraphics packages to address 1 CVE. Fixed in 1.8-tuxcare.1.
- Record
CLSA-2026-1780966324- Updated
- 2026-11-02
OSVCLSA-2026-1789363119 No score
TuxCare security update for commons-configuration:commons-configuration (1 CVE)
TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.8-tuxcare.1.
- Record
CLSA-2026-1789363119- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13743-1 No score
xmlgraphics-batik-1.17-1.1 on GA media
These are all security issues fixed in the xmlgraphics-batik-1.17-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13743-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0777-1 No score
Security update for xmlgraphics-batik
This update for xmlgraphics-batik fixes the following issues:
- CVE-2017-5662: Fixed Apache Batik information disclosure vulnerability (bsc#1034675).
- CVE-2019-17566: Fixed SSRF vulnerability (bsc#1172961).
- CVE-2020-11987: Fixed Apache XML Graphics Batik SSRF vulnerability (bsc#1182748).
- CVE-2022-38398: Fixed information disclosure vulnerability (bsc#1203674).
- CVE-2022-38648: Fixed information disclosure vulnerability (bsc#1203673).
- CVE-2022-40146: Fixed information disclosure vulnerability (bsc#1203672).
- CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).
- CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).
- CVE-2022-44729: Fixed Server-Side Request Forgery.
- CVE-2022-44730: Fixed Server-Side Request Forgery.
Upgrade to version 1.17.
- Record
SUSE-SU-2024:0777-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0808-1 No score
Security update for xmlgraphics-batik
This update for xmlgraphics-batik fixes the following issues:
- CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).
- CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).
- CVE-2022-44730: Fixed Server-Side Request Forgery.
- CVE-2022-44729: Fixed Server-Side Request Forgery.
Upgrade to version 1.17.
- Record
SUSE-SU-2024:0808-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.xmlgraphics:batik-bridgeMaven |
1.0 up to 1.17 | 1.17 |
org.apache.xmlgraphics:batik-svgrasterizerMaven |
1.0 up to 1.17 | 1.17 |
org.apache.xmlgraphics:batik-transcoderMaven |
1.0 up to 1.17 | 1.17 |
org.apache.xmlgraphics:batik-animTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-awt-utilTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-bridgeTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-codecTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-cssTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-domTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-extTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
Show 45 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.xmlgraphics:batik-extensionTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-extensionsTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-gui-utilTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-gvtTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-jsTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-parserTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-rasterizerTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-rasterizer-extTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-scriptTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-slideshowTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-squiggleTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-squiggle-extTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-svg-domTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-svggenTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-svgppTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-swingTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-transcoderTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-ttf2svgTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-utilTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-xmlTuxCare:Maven |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-bridgeTuxCare:Maven |
1.8 up to 1.8-tuxcare.1 | 1.8-tuxcare.1 |
org.apache.xmlgraphics:batik-transcoderTuxCare:Maven |
1.8 up to 1.8-tuxcare.1 | 1.8-tuxcare.1 |
batikDebian:12 |
before 1.16+dfsg-1+deb12u1, plus listed versions 1.16+dfsg-1 |
1.16+dfsg-1+deb12u1 |
batikDebian:13 |
before 1.17+dfsg-1 | 1.17+dfsg-1 |
batikDebian:14 |
before 1.17+dfsg-1 | 1.17+dfsg-1 |
batikDebian:10 |
before 1.10-2+deb10u3, plus listed versions 1.10-21.10-2+deb10u11.10-2+deb10u2 |
1.10-2+deb10u3 |
org.apache.xmlgraphics:batik-bridgeMaven |
1.0 up to 1.17, plus listed versions 1.101.111.121.131.14 Show 7 moreShow less1.151.161.6.11.71.81.91.9.1 |
1.17 |
org.apache.xmlgraphics:batik-svgrasterizerMaven |
1.0 up to 1.17, plus listed versions 1.101.111.121.131.14 Show 4 moreShow less1.151.161.91.9.1 |
1.17 |
org.apache.xmlgraphics:batik-transcoderMaven |
1.0 up to 1.17, plus listed versions 1.101.111.121.131.14 Show 7 moreShow less1.151.161.6.11.71.81.91.9.1 |
1.17 |
batikopenEuler:20.03-LTS-SP1 |
before 1.17-1.oe1 | 1.17-1.oe1 |
batikopenEuler:20.03-LTS-SP3 |
before 1.17-1.oe1 | 1.17-1.oe1 |
batikopenEuler:22.03-LTS |
before 1.17-1.oe2203sp2 | 1.17-1.oe2203sp2 |
batikopenEuler:22.03-LTS-SP1 |
before 1.17-1.oe2203sp1 | 1.17-1.oe2203sp1 |
batikopenEuler:22.03-LTS-SP2 |
before 1.17-1.oe2203sp2 | 1.17-1.oe2203sp2 |
xmlgraphics-batikSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.17-2.7.1 | 1.17-2.7.1 |
xmlgraphics-batikSUSE:Linux Enterprise Module for Development Tools 15 SP5 |
before 1.17-150200.4.7.1 | 1.17-150200.4.7.1 |
xmlgraphics-batikopenSUSE:Leap 15.5 |
before 1.17-150200.4.7.1 | 1.17-150200.4.7.1 |
batikUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.7.ubuntu-8ubuntu31.8-31.8-3ubuntu11.8-3ubuntu1+esm1 |
None known |
batikUbuntu:18.04:LTS |
All versions, plus listed versions 1.9-31.10-2~18.041.10-2~18.04.1 |
None known |
batikUbuntu:20.04:LTS |
All versions, plus listed versions 1.10-21.12-11.12-1ubuntu0.1 |
None known |
batikUbuntu:22.04:LTS |
All versions, plus listed versions 1.12-41.14-11.14-1ubuntu0.2 |
None known |
batikUbuntu:24.04:LTS |
All versions, plus listed versions 1.16+dfsg-11.17+dfsg-1 |
None known |
batikUbuntu:25.10 |
All versions, plus listed versions 1.18+dfsg-2 |
None known |
batikUbuntu:26.10 |
All versions, plus listed versions 1.18+dfsg-2build11.19-2 |
None known |
batikUbuntu:26.04:LTS |
All versions, plus listed versions 1.18+dfsg-21.18+dfsg-2build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-44729 is a high vulnerability (CVSS 7.1) in Apache Xml Graphics Batik, published August 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. Fixed in org.apache.xmlgraphics:batik-bridge 1.17.
References
xmlgraphics.apache.org/security.html
lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2
openwall.com/lists/oss-security/2023/08/22/2
lists.debian.org/debian-lts-announce/2023/10/msg00021.html
security.gentoo.org/glsa/202401-11
Show 34 moreShow less
nvd.nist.gov/vuln/detail/CVE-2022-44729
github.com/apache/xmlgraphics-batik/commit/85b3457d9902f64d5d409a8da060d5ba47d0b69b
issues.apache.org/jira/browse/BATIK-1349
security-tracker.debian.org/tracker/CVE-2022-44729
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1651
suse.com/support/update/announcement/2024/suse-su-20240777-1
bugzilla.suse.com/1034675
ubuntu.com/security/CVE-2022-44729
cve.org/CVERecord?id=CVE-2022-44729