org.apache.xmlgraphics/batik-bridge vulnerabilities

Latest org.apache.xmlgraphics/batik-bridge CVEs

Newest publication first

1. CVE-2026-89326 Apache XML Graphics Batik: Check url protocol when loading document

   Published 2026-11-11

   Unknown EPSS 0.13%

   Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.

2. CVE-2026-49236 Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checks

   Published 2026-11-11

   Unknown EPSS 0.20%

   Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes...

3. CVE-2026-111792 Apache XML Graphics Batik: Denial of Service via SVG Element Reference Resolution

   Published 2026-11-11

   Unknown EPSS 0.21%

   Uncontrolled Recursion vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.

4. CVE-2022-44729 Apache XML Graphics Batik: Information disclosure vulnerability

   Published 2023-08-22

   High·CVSS 7.1 EPSS 0.92%

   Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in so...

5. CVE-2022-42890 Apache Batik prior to 1.16 allows RCE via scripting

   Published 2022-10-25

   High·CVSS 7.5 EPSS 3.4%

   A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.

6. CVE-2022-38398 Server-Side Request Forgery Information Disclosure Vulnerability

   Published 2022-09-22

   Medium·CVSS 5.3 EPSS 2.6%

   Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.

7. CVE-2022-38648 PDFTranscoder does not block external resources

   Published 2022-09-22

   Medium·CVSS 5.3 EPSS 2.4%

   Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.