Live › vulnerability › CVE-2026-117540
Go to dashboardsvg-sanitizer versions from 0.5.3 before 1.1.0 rescan the whole input repeatedly while stripping PHP tags, so the cost grows quadratically with input size. An unauthenticated attacker who uploads an SVG with many overlapping PHP tag openers and closers can tie up worker CPU for minutes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Applications that accept SVG uploads from users and pass them through svg-sanitizer's Sanitizer::sanitize() are exposed, since the upload path is unauthenticated in the attack described. Systems that never accept user-supplied SVG files, or that do not use this library, can skip it.
No product ranges from the sources yet.
composer show enshrined/svg-sanitizer (unknown if the sources do not name this exact package path; confirm the vendor name)0.5.3 up to but not including 1.1.0Sanitizer::sanitize() on user-uploaded SVG files1.1.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes.
This page as .md · .json · in your agent: get_signal("CVE-2026-117540")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.