CVE-2022-40146: Apache Batik Server-Side Request Forgery
Summary
CVE-2022-40146: Apache Batik vulnerable to Server-Side Request Forgery. Affects org.apache.xmlgraphics:batik versions >= 1.0, < 1.15. Fixed in 1.15. How to fix ↓
Also tracked for
- batik · Debian:11
The same CVE-2022-40146 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Batik is an open-source Java-based toolkit for rendering SVG images. It provides a set of APIs and utilities for manipulating and displaying SVG content. The vulnerability identified as CVE-2022-40146 affects Apache XML Graphics Batik version 1.14. This vulnerability allows an attacker to exploit a Server-Side Request Forgery (SSRF) flaw in Batik, enabling unauthorized access to files using a Jar URL.
Vulnerability Detail
The Server-Side Request Forgery (SSRF) vulnerability in Apache Batik allows an attacker to manipulate the application to make arbitrary requests on behalf of the server. By leveraging the SSRF flaw, an attacker can access files using a Jar URL, potentially leading to unauthorized disclosure of sensitive information or remote code execution. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 1.20 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.15
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation and filtering to prevent the exploitation of SSRF vulnerabilities. This can involve validating user-supplied URLs and restricting access to sensitive resources. Here is an example of input validation in Java:
String url = getUserInput();
URL validatedUrl = new URL(url);
// Perform further checks and restrictions on the validated URL
Please note that this workaround is not a permanent solution and should be replaced with the recommended fix as soon as possible.
Conclusion
The Server-Side Request Forgery (SSRF) vulnerability in Apache Batik can be mitigated by upgrading to the fixed version, 1.15. Implementing input validation and filtering can serve as a temporary workaround until the upgrade is performed. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.xmlgraphics:batik →
FAQ
Apache Batik is an open-source Java-based toolkit for rendering SVG images. It provides APIs and utilities for manipulating and displaying SVG content.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to manipulate a server to make arbitrary requests on behalf of the server, potentially leading to unauthorized access or disclosure of sensitive information.
The vulnerability in Apache Batik allows an attacker to access files using a Jar URL, potentially leading to unauthorized disclosure of sensitive information or remote code execution.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to Apache XML Graphics Batik version 1.15 or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.xmlgraphics:batik.
