{"id":"CVE-2026-117540","kind":"vulnerability","aliases":["CVE-2026-117540"],"related":[],"title":"svg-sanitizer: crafted SVG upload exhausts CPU in sanitize()","description":"svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes.","summary":"svg-sanitizer versions from 0.5.3 before 1.1.0 rescan the whole input repeatedly while stripping PHP tags, so the cost grows quadratically with input size. An unauthenticated attacker who uploads an SVG with many overlapping PHP tag openers and closers can tie up worker CPU for minutes.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["composer","package","php","self-hosted","svg-upload"],"not_affected_if":["library-not-used","no-svg-upload"],"how_to_check":"- Check the installed version of svg-sanitizer with `composer show enshrined/svg-sanitizer` (unknown if the sources do not name this exact package path; confirm the vendor name)\n- Search the lock file for svg-sanitizer and look for a version from `0.5.3` up to but not including `1.1.0`\n- Find code paths that call `Sanitizer::sanitize()` on user-uploaded SVG files","fix":"- Upgrade svg-sanitizer to `1.1.0` or later\n- Until upgraded, reject or size-limit uploaded SVG files before sanitizing them","status":"open","published_at":"2026-10-27T11:17:34+00:00","first_seen_at":"2026-10-27T11:31:28+00:00","triaged_at":"2026-10-27T11:31:38+00:00","updated_at":"2026-10-27T11:31:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T11:31:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade svg-sanitizer to `1.1.0` or later\n- Until upgraded, reject or size-limit uploaded SVG files before sanitizing them","reach":"internet","title":"svg-sanitizer: crafted SVG upload exhausts CPU in sanitize()","impact":"low","summary":"svg-sanitizer versions from 0.5.3 before 1.1.0 rescan the whole input repeatedly while stripping PHP tags, so the cost grows quadratically with input size. An unauthenticated attacker who uploads an SVG with many overlapping PHP tag openers and closers can tie up worker CPU for minutes.","category":"package","nicknames":[],"who_cares":["php","composer","svg-upload","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Worker CPU is exhausted for minutes, causing denial of service","analyst_note":"Confirm the affected package name and the NVD CVSS vector; the sources give only the description and an 8.7 score, with no published fix commit or advisory link.","how_to_check":"- Check the installed version of svg-sanitizer with `composer show enshrined/svg-sanitizer` (unknown if the sources do not name this exact package path; confirm the vendor name)\n- Search the lock file for svg-sanitizer and look for a version from `0.5.3` up to but not including `1.1.0`\n- Find code paths that call `Sanitizer::sanitize()` on user-uploaded SVG files","needs_analyst":true,"not_affected_if":["no-svg-upload","library-not-used"],"who_is_affected":"Applications that accept SVG uploads from users and pass them through svg-sanitizer's Sanitizer::sanitize() are exposed, since the upload path is unauthenticated in the attack described. Systems that never accept user-supplied SVG files, or that do not use this library, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000681,"input_tokens":3365,"output_tokens":689,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117540':13A,16A '-2026':12A,15A '0.5.3':31B,77C '1.1.0':33B,79C 'attack':53B,100C 'closer':65B,111C 'compos':17B 'contain':80C 'cost':45B 'cpu':8A,70B,120C 'craft':4A 'cve':11A,14A 'denial':82C 'exhaust':7A,118C 'forc':112C 'grow':46B 'host':22B 'input':37B,49B,94C 'mani':59B,105C 'minut':72B,122C 'open':63B,109C 'overlap':60B,106C 'packag':18B 'pass':116C 'php':19B,41B,61B,97C,107C 'preg':114C 'quadrat':47B,113C 'repeat':38B,90C 'replac':115C 'rescan':34B,91C 'sanit':3A,10A,28B,75C,87C,88C 'self':21B 'self-host':20B 'servic':84C 'size':50B 'strip':40B,96C 'svg':2A,5A,24B,27B,57B,74C 'svg-sanit':1A,26B,73C 'svg-upload':23B 'svgs':103C 'tag':42B,62B,98C,108C 'tie':67B 'unauthent':52B,99C 'upload':6A,25B,55B,102C 'version':29B 'vulner':85C 'whole':36B,93C 'worker':69B,119C","nicknames":[],"mitigations":[],"who_affected":"Applications that accept SVG uploads from users and pass them through svg-sanitizer's Sanitizer::sanitize() are exposed, since the upload path is unauthenticated in the attack described. Systems that never accept user-supplied SVG files, or that do not use this library, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117540","severity":null,"published_at":"2026-10-27T11:17:34+00:00","modified_at":"2026-10-27T11:17:34+00:00","first_seen_at":"2026-10-27T11:31:28+00:00","fetched_at":"2026-10-27T11:31:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}