CVE-2022-42890

CVE-2022-42890 is a vulnerability in Apache Batik (XML Graphics Project) that allows an attacker to run arbitrary Java code from untrusted SVG via JavaScript. The issue affects Apache Batik prior to version 1.16; multiple advisories note upgrading to 1.16 or newer as the remediation (e.g., Debian...

CVE-2022-40146

CVE-2022-40146 is a Server-Side Request Forgery in Apache XML Graphics Batik (version 1.14) that allows an attacker to access files via a Jar URL. Multiple connected advisories confirm the vulnerability and urge upgrading Batik to patched versions; Debian and Gentoo advisories show Batik updates ...

CVE-2022-41704

CVE-2022-41704 concerns the Apache Batik library (Apache XML Graphics) and allows a remote attacker to run untrusted Java code from an SVG. The issue affects Batik versions prior to 1.16, with a recommended upgrade to 1.16. Connected documents corroborate the vulnerability details across multiple...

CVE-2022-38398

CVE-2022-38398 is a Server-Side Request Forgery (SSRF) in Apache Batik (SVG toolkit) affecting Batik 1.14, loadable via jar protocol. The vulnerability enables loading arbitrary URLs by crafting a request that bypasses normalization in Batik components. Public records show multiple vendors refere...

CVE-2022-38648

CVE-2022-38648 is a Server-Side Request Forgery (SSRF) in Apache Batik (Apache XML Graphics Batik). Public docs confirm the issue affects Batik 1.14 and describes SSRF that can fetch external resources via Batik’s processing. Connected sources show fixes/mitigations across ecosystems: Debian LTS ...