TI-2022-20096 Aliases CVE-2022-41704 GHSA-r29w-r9ph-vm76

Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input

MEDIUM 44CWE-918Published 2022-10-25 · Updated 2026-02-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 2 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.

Summary

A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.03099 87th percentileScored 2026-11-07

Fix Partial org.apache.xmlgraphics:batik (Maven): 1.16Red Hat: 2 advisoriesRed Hat: 2 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache XML Graphics	Batik – 1.15	—	No fix listed	CNA
—	org.apache.xmlgraphics:batik (Maven)	before 1.16	1.16	Patch available	GHSA-r29w-r9ph-vm76

Apache XML Graphics VendorApache Affected Batik – 1.15 Fixed in — No fix listed CNA
org.apache.xmlgraphics:batik (Maven) Vendor— Affected before 1.16 Fixed in 1.16 Patch available GHSA-r29w-r9ph-vm76

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:batik::::::::	1.0 to before 1.16	Vulnerable	Apache
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian
cpe:2.3:o:debian:debian_linux:11.0:::::::*	11.0	Vulnerable	Debian

cpe:2.3:a:apache:batik:*:*:*:*:*:*:*:* Versions 1.0 to before 1.16 Vulnerable ·Apache
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

Fix · GHSA-r29w-r9ph-vm76 org.apache.xmlgraphics:batik (Maven) Fixed in 1.16 Advisory →

Red Hat 2 advisories

RHSA-2023:3954 Released 2023-06-29 · Red Hat rating Critical
Red Hat Fuse 7.12 release and security update
- Red Hat Fuse 7.12
RHSA-2023:2100 Released 2023-05-03 · Red Hat rating Important
Red Hat Integration Camel for Spring Boot 3.20.1 security update
- RHINT Camel-Springboot 3.20.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2022-10-25
Apache XML Graphics — DSA-5264
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-20886 Apache Batik prior to 1.16 allows RCE via scriptingPriority LOW 39
Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Decision Manager 7	Affected	No fix planned: Out of support scope
Red Hat Integration Camel K 1	Affected	No fix planned: Will not fix
Red Hat Integration Camel Quarkus 2	Affected	No fix planned: Will not fix
Red Hat JBoss Data Grid 7	Affected	No fix planned: Out of support scope
Red Hat Process Automation 7	Affected	No fix planned: Out of support scope
RHINT Camel-Springboot 3.20.1	Fixed	RHSA-2023:2100
Red Hat Fuse 7.12	Fixed	RHSA-2023:3954

Timeline

2026-10-02 Threatist record created from CVE-2022-41704
2026-10-03 Alias added: GHSA-r29w-r9ph-vm76

References

Advisory 6

Other 4

TI-2018-05790 Deserialization of untrusted data in Apache Batik CVSS 3.0CRITICAL 9.8
TI-2020-09647 Improper input validation in Apache Batik CVSS 3.1HIGH 8.2
TI-2019-13109 Server-side request forgery in Apache Batik CVSS 3.1HIGH 7.5
TI-2015-00219 XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion… CVSS 2.0MEDIUM 6.4
TI-2022-19036 Jar url should be blocked by DefaultScriptSecurity CVSS 3.1HIGH 7.5
TI-2022-20886 Apache Batik prior to 1.16 allows RCE via scripting CVSS 3.1HIGH 7.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences