{"id":"CVE-2022-38648","aliases":["CLSA-2026-1778633124","CLSA-2026-1784856219","DEBIAN-CVE-2022-38648","DLA-3619-1","DLA-4243-1","EUVD-2022-6702","GHSA-53jm-3hc9-fqqc","MGASA-2024-0068","OESA-2023-1651","SUSE-SU-2024:0777-1","UBUNTU-CVE-2022-38648","USN-6117-1","openSUSE-SU-2024:12363-1"],"status":"published","title":"PDFTranscoder does not block external resources","description":"Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02425,"percentile":0.84323,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2022-09-22T00:00:00Z","modified":"2026-11-03T08:02:25Z","fixes":[{"ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","fixed_in":["1.15"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-bridge","fixed_in":["1.15"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-bridge","fixed_in":["1.8-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"batik","fixed_in":["1.15+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"batik","fixed_in":["1.15+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"batik","fixed_in":["1.15+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"batik","fixed_in":["1.7.ubuntu-8ubuntu2.14.04.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"batik","fixed_in":["1.8-3ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"batik","fixed_in":["1.10-2~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"batik","fixed_in":["1.12-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"batik","fixed_in":["1.14-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-anim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-awt-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-css","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-extension","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-gui-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-gvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-rasterizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-rasterizer-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-slideshow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-squiggle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-squiggle-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svg-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svggen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svgpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-swing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-transcoder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-ttf2svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8"},{"fixed":"1.8-tuxcare.3"}]}],"versions":["1.8","1.8-tuxcare.1","1.8-tuxcare.2"]},{"source":"osv","ecosystem":"Debian:12","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-2+deb10u3"}]}],"versions":["1.10-2","1.10-2+deb10u1","1.10-2+deb10u2"],"bundled":6},{"source":"osv","ecosystem":"Debian:11","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-4+deb11u3"}]}],"versions":["1.12-4","1.12-4+deb11u1","1.12-4+deb11u2"],"bundled":4},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15"}]}],"versions":["1.10","1.11","1.12","1.13","1.14","1.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15"}]}],"versions":["1.10","1.11","1.12","1.13","1.14","1.6.1","1.7","1.8","1.9","1.9.1"]},{"source":"osv","ecosystem":"Mageia:9","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-4.1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe2203sp2"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe2203sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-1.oe2203sp2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-2.7.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.ubuntu-8ubuntu2.14.04.3+esm1"}]}],"versions":["1.7.ubuntu-8ubuntu2","1.7.ubuntu-8ubuntu2.14.04.1","1.7.ubuntu-8ubuntu2.14.04.2","1.7.ubuntu-8ubuntu2.14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-3ubuntu1+esm1"}]}],"versions":["1.7.ubuntu-8ubuntu3","1.8-3","1.8-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-2~18.04.1"}]}],"versions":["1.9-3","1.10-2~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1ubuntu0.1"}]}],"versions":["1.10-2","1.12-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-1ubuntu0.2"}]}],"versions":["1.12-4","1.14-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16+dfsg-1","1.17+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18+dfsg-2build1","1.19-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18+dfsg-2","1.18+dfsg-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.ubuntu-8ubuntu2.14.04.3+esm1"}]}],"versions":["1.7.ubuntu-8ubuntu2","1.7.ubuntu-8ubuntu2.14.04.1","1.7.ubuntu-8ubuntu2.14.04.2","1.7.ubuntu-8ubuntu2.14.04.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-3ubuntu1+esm1"}]}],"versions":["1.7.ubuntu-8ubuntu3","1.8-3","1.8-3ubuntu1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-2~18.04.1"}]}],"versions":["1.9-3","1.10-2~18.04"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1ubuntu0.1"}]}],"versions":["1.10-2","1.12-1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-1ubuntu0.2"}]}],"versions":["1.12-4","1.14-1"],"bundled":7}],"products":[{"vendor":"apache","product":"batik"},{"vendor":"apache software foundation","product":"apache xml graphics"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://lists.apache.org/thread/gfsktxvj7jtwyovmhhbrw0bs13wfjd7b","tags":["x_transferred","Mailing List","Vendor Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html","tags":["mailing-list","x_transferred","Mailing List","article","web"]},{"url":"https://security.gentoo.org/glsa/202401-11","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00006.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38648","tags":["advisory"]},{"url":"https://issues.apache.org/jira/browse/BATIK-1333","tags":["web"]},{"url":"https://github.com/apache/xmlgraphics-batik/commit/996aa8897c208be11ce65cef00c9576a299b2637","tags":["web"]},{"url":"https://github.com/advisories/GHSA-53jm-3hc9-fqqc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38648.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-38648","tags":["advisory"]},{"url":"https://github.com/apache/xmlgraphics-batik","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2024-0068.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30882","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2022/09/22/2","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2022/09/22/3","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2022/09/22/4","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2022/10/25/2","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2022/10/25/3","tags":["web"]},{"url":"https://www.debian.org/security/2022/dsa-5264","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-6117-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1651","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38398","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40146","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44730","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240777-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1034675","tags":["report"]},{"url":"https://bugzilla.suse.com/1172961","tags":["report"]},{"url":"https://bugzilla.suse.com/1182748","tags":["report"]},{"url":"https://bugzilla.suse.com/1203672","tags":["report"]},{"url":"https://bugzilla.suse.com/1203673","tags":["report"]},{"url":"https://bugzilla.suse.com/1203674","tags":["report"]},{"url":"https://bugzilla.suse.com/1204704","tags":["report"]},{"url":"https://bugzilla.suse.com/1204709","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44730","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-38648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-38648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-38398","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-40146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-42890","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-38648","title":"PDFTranscoder does not block external resources","description":"Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.","status":"published","published":"2022-09-22T00:00:00Z","modified":"2025-11-03T19:27:25.993Z","cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:37.599536Z"}],"euvd":[{"id":"EUVD-2022-6702","description":"Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.","status":"published","published":"2022-09-22T00:00:00Z","modified":"2025-11-03T19:27:25Z","updated_at":"2026-11-02T19:49:34.152725Z"}],"ghsa":[{"id":"GHSA-53jm-3hc9-fqqc","title":"Apache Batik vulnerable to Server-Side Request Forgery","description":"Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik Bridge versions 1.14 and below.","status":"published","published":"2022-09-23T00:00:40Z","modified":"2025-11-03T21:31:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2022-38648","description":"Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.","status":"published","published":"2022-09-22T15:15:09.35Z","modified":"2026-06-17T04:56:56.043Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:07:28.501364Z"}],"osv":[{"id":"DEBIAN-CVE-2022-38648","description":"Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.","status":"published","published":"2022-09-22T15:15:09.35Z","modified":"2026-11-03T08:02:25.455227686Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"GHSA-53jm-3hc9-fqqc","title":"Apache Batik vulnerable to Server-Side Request Forgery","description":"Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik Bridge versions 1.14 and below.","status":"published","published":"2022-09-23T00:00:40Z","modified":"2025-11-03T22:02:58.36624Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"OESA-2023-1651","title":"batik security update","description":"Batik is an inline templating engine for CoffeeScript, inspired by CoffeeKup,  that lets you write your template directly as a CoffeeScript function.\r\n\r\nSecurity Fix(es):\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-38398)\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-38648)\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.(CVE-2022-40146)\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\r\n\r\nOn version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.\r\n\r\n(CVE-2022-44729)\r\n\r\nServer-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.\r\n\r\nA malicious SVG can probe user profile / data and send it directly as parameter to a URL.\r\n\r\n(CVE-2022-44730)","status":"published","published":"2023-09-15T11:06:06Z","modified":"2026-08-18T01:16:36.941225638Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"UBUNTU-CVE-2022-38648","description":"Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.","status":"published","published":"2022-09-22T15:15:00Z","modified":"2026-10-17T12:55:59.161090394Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"CLSA-2026-1778633124","title":"TuxCare security update for org.apache.xmlgraphics (10 CVEs)","description":"TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:46:30.414053178Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1784856219","title":"TuxCare security update for org.apache.xmlgraphics:batik-bridge (1 CVE)","description":"TuxCare rebuilt org.apache.xmlgraphics:batik-bridge to address 1 CVE. Fixed in 1.8-tuxcare.3.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-11-02T19:45:44.902752337Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CVE-2022-38648","title":"PDFTranscoder does not block external resources","description":"Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.","status":"published","published":"2022-09-22T00:00:00Z","modified":"2026-10-28T02:30:48.311406914Z","cwes":["CWE-918"],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"DLA-3619-1","title":"batik - security update","status":"published","published":"2023-10-14T00:00:00Z","modified":"2026-03-09T01:23:12.351122Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-4243-1","title":"batik - security update","status":"published","published":"2025-07-20T00:00:00Z","modified":"2026-03-09T02:10:07.441567Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2024-0068","title":"Updated batik packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nServer-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML\nGraphics allows an attacker to load a url thru the jar protocol.\n(CVE-2022-38398)\nServer-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML\nGraphics allows an attacker to fetch external resources.\n(CVE-2022-38648)\nServer-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML\nGraphics allows an attacker to access files using a Jar url.\n(CVE-2022-40146)\nA vulnerability in Batik of Apache XML Graphics allows an attacker to\nrun untrusted Java code from an SVG. (CVE-2022-41704)\nA vulnerability in Batik of Apache XML Graphics allows an attacker to\nrun Java code from untrusted SVG via JavaScript. (CVE-2022-42890)\n","status":"published","published":"2024-03-16T16:28:17Z","modified":"2026-04-16T04:41:36.919512436Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:12363-1","title":"xmlgraphics-batik-1.15-1.1 on GA media","description":"These are all security issues fixed in the xmlgraphics-batik-1.15-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:51:37.815813Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2024:0777-1","title":"Security update for xmlgraphics-batik","description":"This update for xmlgraphics-batik fixes the following issues:\n\n- CVE-2017-5662: Fixed Apache Batik information disclosure vulnerability (bsc#1034675).\n- CVE-2019-17566: Fixed SSRF vulnerability (bsc#1172961).\n- CVE-2020-11987: Fixed Apache XML Graphics Batik SSRF vulnerability (bsc#1182748).\n- CVE-2022-38398: Fixed information disclosure vulnerability (bsc#1203674).\n- CVE-2022-38648: Fixed information disclosure vulnerability (bsc#1203673).\n- CVE-2022-40146: Fixed information disclosure vulnerability (bsc#1203672).\n- CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).\n- CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).\n- CVE-2022-44729: Fixed Server-Side Request Forgery.\n- CVE-2022-44730: Fixed Server-Side Request Forgery.\n\nUpgrade to version 1.17.\n","status":"published","published":"2024-03-06T11:54:24Z","modified":"2026-02-04T03:34:59.610627Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-6117-1","title":"batik vulnerabilities","description":"It was discovered that Apache Batik incorrectly handled certain inputs. An\nattacker could possibly use this to perform a cross site request forgery\nattack. (CVE-2019-17566, CVE-2020-11987, CVE-2022-38398, CVE-2022-38648)\n\nIt was discovered that Apache Batik incorrectly handled Jar URLs in some\nsituations. A remote attacker could use this issue to access files on the\nserver. (CVE-2022-40146)\n\nIt was discovered that Apache Batik allowed running untrusted Java code from\nan SVG. An attacker could use this issue to cause a denial of service,\nor possibly execute arbitrary code. (CVE-2022-41704, CVE-2022-42890)\n","status":"published","published":"2023-05-30T14:31:05Z","modified":"2026-06-29T13:50:48.321211924Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}