Apache Batik vulnerable to Server-Side Request Forgery

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-40146 · ADVISORY
• apache/xmlgraphics-batik · PACKAGE
• issues.apache.org/jira/browse/BATIK-1335 · WEB
• lists.apache.org/thread/hxtddqjty2sbs12y97c8g7xfh17jzxsx · WEB
• lists.debian.org/debian-lts-announce/2023/10/msg00021.html · WEB
• lists.debian.org/debian-lts-announce/2025/07/msg00006.html · WEB
• security.gentoo.org/glsa/202401-11 · WEB

More vulnerabilities in org.apache.xmlgraphics:batik

• CVE-2022-42890HIGH 7.5A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Ap…
• CVE-2022-41704HIGH 7.5A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Gra…
• CVE-2022-38648MEDIUM 5.3Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue …
• CVE-2022-38398MEDIUM 5.3Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. Thi…
• CVE-2019-17566HIGH 7.5Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a sp…