org.apache.xmlgraphics/batik vulnerabilities

Latest org.apache.xmlgraphics/batik CVEs

Newest publication first

1. CVE-2022-42890 Apache Batik prior to 1.16 allows RCE via scripting

   Published 2022-10-25

   High·CVSS 7.5

   A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.

2. CVE-2022-41704 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input

   Published 2022-10-25

   High·CVSS 7.5

   A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.

3. CVE-2022-40146 Jar url should be blocked by DefaultScriptSecurity

   Published 2022-09-22

   High·CVSS 7.5

   Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

4. CVE-2022-38398 Server-Side Request Forgery Information Disclosure Vulnerability

   Published 2022-09-22

   Medium·CVSS 5.3

   Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.

5. CVE-2022-38648 PDFTranscoder does not block external resources

   Published 2022-09-22

   Medium·CVSS 5.3

   Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

6. CVE-2019-17566 Server-side request forgery (SSRF) in Apache Batik

   Published 2020-11-12

   High·CVSS 7.5

   Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

7. CVE-2018-8013 Deserialization of Untrusted Data in Apache Batik

   Published 2018-05-24

   Critical·CVSS 9.8

   In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deseriali...

8. CVE-2017-5662 Improper Restriction of XML External Entity Reference in Apache Batik

   Published 2017-04-18

   High·CVSS 7.3 EPSS 4.1%

   In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the u...

9. CVE-2015-0250 Improper Input Validation in Apache Batik

   Published 2015-03-24

   Medium·CVSS 6.4 EPSS 16.6% Public exploit

   XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.