CVE-2022-40146 is a Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik 1.14, allowing attackers to access local files via a Jar URL. With a CVSS score of 7.5 (High), this vulnerability can be exploited remotely without user interaction, leading to high confidentiality impact. While no public exploits or active exploitation have been observed, and community discussion is minimal, its high EPSS and FAUCET Risk Score indicate a significant potential risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.14CPE matchmatch criteria | cpe:2.3:a:apache:batik:1.14:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Third-Party Package Updates in Splunk AppDynamics On-Premises Enterprise Console - August 2025
Aug 6, 2025Apache Batik vulnerable to Server-Side Request Forgery
Sep 23, 2022batik: Server-Side Request Forgery (SSRF) vulnerability
Sep 22, 2022