# org.apache.xmlgraphics:batik (Maven) vulnerabilities

9 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.apache.xmlgraphics/batik

## Advisories (9)

### [CVE-2022-42890](https://cve.now/CVE-2022-42890): Apache Batik prior to 1.16 allows RCE via scripting

- Severity: Unrated
- Published: Oct 25, 2022
- Affected: fixed in 1.16.

### [CVE-2022-41704](https://cve.now/CVE-2022-41704): Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input

- Severity: High 7.5
- Published: Oct 25, 2022
- Affected: fixed in 1.16.

### [CVE-2022-40146](https://cve.now/CVE-2022-40146): Jar url should be blocked by DefaultScriptSecurity

- Severity: Unrated
- Published: Sep 22, 2022
- Affected: from 1.0, fixed in 1.15.

### [CVE-2022-38648](https://cve.now/CVE-2022-38648): PDFTranscoder does not block external resources

- Severity: Unrated
- Published: Sep 22, 2022
- Affected: fixed in 1.15.

### [CVE-2022-38398](https://cve.now/CVE-2022-38398): Server-Side Request Forgery Information Disclosure Vulnerability

- Severity: Unrated
- Published: Sep 22, 2022
- Affected: from 1.14, fixed in 1.15.

### [CVE-2019-17566](https://cve.now/CVE-2019-17566): Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes.

- Severity: Unrated
- Published: Nov 12, 2020
- Affected: fixed in 1.13.

### [CVE-2018-8013](https://cve.now/CVE-2018-8013): In Apache Batik 1.x before 1.10, when deserializing subclass of \`AbstractDocument\`, the class takes a string from the inputStream as the…

- Severity: Unrated
- Published: May 24, 2018
- Affected: from 1.0, fixed in 1.10.

### [CVE-2017-5662](https://cve.now/CVE-2017-5662): In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send…

- Severity: Unrated
- Published: Apr 18, 2017
- Affected: fixed in 1.9.

### [CVE-2015-0250](https://cve.now/CVE-2015-0250): XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote…

- Severity: Unrated
- Published: Mar 24, 2015
- Affected: from 1.0, fixed in 1.8.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.xmlgraphics:batik
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.