CVE-2025-47778 Details
Description
Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for insecure XML External Entity References. The problem has been patched in versions 2.6.9, 2.5.25, and 3.0.0-alpha3. As a workaround, one may patch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` manually.
A vulnerability allowing XML External Entity (XXE) injection has been identified in Sulu, an open-source PHP content management system. This issue affects versions 2.5.21, 2.6.5, and 3.0.0-alpha1. The vulnerability arises because an admin user can upload SVG files that may load external data through the XML DOM library, potentially leading to insecure XXE references.
Users can manually patch the vulnerable SvgFileInspector.php file by modifying the XML loading function to disable network access and entity loading. Alternatively, users should upgrade to Sulu versions 2.6.9, 2.5.25, or 3.0.0-alpha3, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 14, 2025CISA-ADP
Assessed May 14, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php | [email protected] | Source CodeVendor |
| https://github.com/sulu/sulu/commit/02f52fca04eb9495b9b4a0c5cc64cf23bc27f544 | [email protected] | Source CodeVendor |
| https://github.com/sulu/sulu/security/advisories/GHSA-f6rx-hf55-4255 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-611 | Improper Restriction of XML External Entity Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sulu | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2025 | New CVE Received | [email protected] |