SB2026090131 - Multiple vulnerabilities in SVG Sanitizer

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090131

SB2026090131 - Multiple vulnerabilities in SVG Sanitizer

Published: September 1, 2026

Security Bulletin ID SB2026090131
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 14% Low 86%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Improper Handling of Case Sensitivity (CVE-ID: N/A)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of case sensitivity in Resolver::processReferences() when processing SVG elements with mixed-case xlink:href attributes. A remote attacker can submit a specially crafted SVG file to cause a denial of service.

User interaction is required to open or render the sanitized SVG output.


2) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to disclose sensitive information through css injection and external resource loading.

The vulnerability exists due to improper neutralization of css content in <style> elements in the SVG Sanitizer when processing sanitized inline SVG content. A remote user can embed crafted css with @import, external url(), or selector-based exfiltration logic to disclose sensitive information through css injection and external resource loading.

This applies only when the sanitized SVG is embedded inline in a host page, and user interaction is required.


3) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to load external resources and disclose limited information.

The vulnerability exists due to improper handling of remote references in <image href> attributes in the SVG Sanitizer when sanitizing SVG content with remote reference removal enabled. A remote user can supply a crafted SVG containing a bare external href on an <image> element to load external resources and disclose limited information.

The issue occurs even when the removeRemoteReferences option is enabled, and it can be used for tracking pixel requests.


4) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to load external resources and disclose limited information.

The vulnerability exists due to improper input validation in the hasRemoteReference() check in the SVG Sanitizer when parsing unquoted url() values. A remote user can provide a crafted SVG attribute containing an unquoted external url() reference to load external resources and disclose limited information.

The issue occurs because the remote reference check only matches quoted url() values.


5) Spoofing attack (CVE-ID: N/A)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause the victim to download attacker-controlled files.

The vulnerability exists due to improper neutralization of dangerous attributes in <a download> handling in the SVG Sanitizer when processing sanitized SVG content containing allowed download attributes and safe-listed data URIs. A remote user can craft an SVG link with an attacker-chosen filename and content source to cause the victim to download attacker-controlled files.

User interaction is required to open the downloaded file.


6) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in the victim\'s browser.

The vulnerability exists due to improper input validation in href validation in svg-sanitize when processing crafted SVG content with DTD entity and HTML5 named character reference collisions. A remote user can upload a specially crafted SVG that passes sanitization and is later rendered inline in HTML to execute arbitrary JavaScript in the victim\'s browser.

User interaction is required to click the rendered link, and exploitation requires the sanitized SVG to be embedded inline in HTML rather than loaded through an img element.


7) Type Confusion (CVE-ID: N/A)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to type confusion in cleanAttributesOnWhitelist() when sanitizing a crafted SVG file containing a DTD attribute declaration. A remote user can upload or submit a specially crafted SVG file to cause a denial of service.

The issue can crash the PHP process and terminate a PHP-FPM worker during SVG sanitization.


Remediation

Install update from vendor's website.

References