PDFTranscoder does not block external resources
Priority LOW 29CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 2 fixed, 8 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.
Summary
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.
Why it matters now
EPSS 0.02425 84th percentileScored 2026-11-07
Fix Partial org.apache.xmlgraphics:batik (Maven): 1.15org.apache.xmlgraphics:batik-bridge (Maven): 1.15Red Hat: 2 advisoriesRed Hat: 2 fixed, 8 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache XML Graphics | Batik 1.14 | — | No fix listed | CNA |
| — | org.apache.xmlgraphics:batik (Maven) | before 1.15 | 1.15 | Patch available | GHSA-53jm-3hc9-fqqc |
| — | org.apache.xmlgraphics:batik-bridge (Maven) | before 1.15 | 1.15 | Patch available | GHSA-53jm-3hc9-fqqc |
- Apache XML Graphics VendorApache Affected Batik 1.14 Fixed in — No fix listed CNA
- org.apache.xmlgraphics:batik (Maven) Vendor— Affected before 1.15 Fixed in 1.15 Patch available GHSA-53jm-3hc9-fqqc
- org.apache.xmlgraphics:batik-bridge (Maven) Vendor— Affected before 1.15 Fixed in 1.15 Patch available GHSA-53jm-3hc9-fqqc
Remediation
- Fix · GHSA-53jm-3hc9-fqqc org.apache.xmlgraphics:batik (Maven) Fixed in 1.15 Advisory →
- Fix · GHSA-53jm-3hc9-fqqc org.apache.xmlgraphics:batik-bridge (Maven) Fixed in 1.15 Advisory →
Red Hat 2 advisories
- RHSA-2023:3954 Released 2023-06-29 · Red Hat rating CriticalRed Hat Fuse 7.12 release and security update
- Red Hat Fuse 7.12
- RHSA-2023:2100 Released 2023-05-03 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.20.1 security update
- RHINT Camel-Springboot 3.20.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat build of Quarkus | Affected | No fix planned: Will not fix |
| RHINT Camel-Springboot 3.20.1 | Fixed | RHSA-2023:2100 |
| Red Hat Fuse 7.12 | Fixed | RHSA-2023:3954 |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-38648
- 2026-10-03 Alias added: GHSA-53jm-3hc9-fqqc
References
Advisory 3
Other 5
- [debian-lts-announce] 20231014 [SECURITY] [DLA 3619-1] batik security update
- https://github.com/apache/xmlgraphics-batik/commit/996aa8897c208be11ce65cef00c9576a299b2637
- https://github.com/apache/xmlgraphics-batik
- https://issues.apache.org/jira/browse/BATIK-1333
- https://lists.debian.org/debian-lts-announce/2025/07/msg00006.html
More Apache Batik vulnerabilities
- TI-2018-05790 Deserialization of untrusted data in Apache Batik CVSS 3.0CRITICAL 9.8
- TI-2020-09647 Improper input validation in Apache Batik CVSS 3.1HIGH 8.2
- TI-2019-13109 Server-side request forgery in Apache Batik CVSS 3.1HIGH 7.5
- TI-2015-00219 XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion… CVSS 2.0MEDIUM 6.4
- TI-2022-20096 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input CVSS 3.1HIGH 7.5
- TI-2022-19036 Jar url should be blocked by DefaultScriptSecurity CVSS 3.1HIGH 7.5
Sources
- CVE-2022-38648 · CVE Program
- CVE-2022-38648 · NVD
- FIRST EPSS
- GHSA-53jm-3hc9-fqqc · GitHub Advisory Database · CC BY 4.0
- CVE-2022-38648 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences