CVE-2022-41704
Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
- State
- Published
- Severity
- 7.5 High
- Published
- Oct 25, 2022
- Updated
- Feb 25, 2026
- Reserved
- Sep 28, 2022
Description
A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
Apache XML GraphicsApache Software Foundation |
|
References
- https://lists.apache.org/thread/hplhx0o74jb7blj39fm4kw3otcnjd6xf
- [oss-security] 20221025 [CVE-2022-41704] Apache Batik information disclosure vulnerabilitymailing-list
- [debian-lts-announce] 20221029 [SECURITY] [DLA 3169-1] batik security updatemailing-list
- DSA-5264vendor-advisory
- GLSA-202401-11vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.