CVE-2026-107379 Details
Description
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attribute name in src/Sanitizer.php. The first removal deletes the explicit attribute, while the DTD default rematerializes the value before the href safety path performs the second removal, which can corrupt libxml state and terminate the PHP worker. An attacker who can submit SVG content to a sanitization endpoint can repeatedly interrupt workers and degrade or exhaust application availability. This issue is fixed in version 1.0.0.
A denial-of-service vulnerability has been identified in the Enshrined SVG-Sanitize library, specifically in versions through 0.22.0. The issue arises when the sanitizer processes a crafted SVG file containing a DTD with a #FIXED attribute. This setup causes the 'cleanAttributesOnWhitelist()' method to inadvertently call 'removeAttribute()' twice on the same attribute, leading to a corruption of the libxml state and a crash of the PHP worker. The vulnerability can be exploited by uploading the malicious SVG to a sanitization endpoint, causing a significant disruption in application availability.
Users are advised to update to Enshrined SVG-Sanitize version 1.0.0, which removes the DTD processing vulnerability by stripping DOCTYPE declarations before parsing the SVG. Instructions for updating can be found in the WordPress Plugin Directory.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-v383-3rw5-q8rf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/darylldoyle/svg-sanitizer/commit/23877db7e76f1e1df5c3e65ab30239219c3d2867 | [email protected] | Source CodeVendor |
| https://github.com/darylldoyle/svg-sanitizer/releases/tag/1.0.0 | [email protected] | Release NotesVendor |
| https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-v383-3rw5-q8rf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| darylldoyle svg-sanitizer | All versions |
CPE
Remediation
| |
| enshrined/svg-sanitize | <= 0.22.0 (semver) |
CPE
Remediation
| |
| WordPress Safe SVG | All versions |
CPE
Remediation
| |
| TYPO3 | All versions |
CPE
Remediation
| |
| Drupal | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |