{"id":"CVE-2026-117541","kind":"vulnerability","aliases":["CVE-2026-117541"],"related":[],"title":"svg-sanitizer: uncaught exception lets crafted SVG crash upload workers","description":"svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize() to throw a LogicException instead of returning false, crashing workers or bypassing upload rejection.","summary":"The svg-sanitizer library throws a LogicException from Sanitizer::sanitize() when given well-formed XML without a top-level svg root, instead of returning false. An attacker can submit such a file to crash the calling process or skip the upload rejection check.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["composer","package","php","self-hosted","svg-upload"],"not_affected_if":["no-svg-uploads","version-1.1.0-or-later"],"how_to_check":"- Run `composer show enshrined/svg-sanitizer` (or check composer.lock) and see whether the installed version is at least `1.1.0`\n- Search the codebase for calls to `Sanitizer::sanitize(` and check whether they catch exceptions around them","fix":"- Upgrade the svg-sanitizer package to `1.1.0` or later\n- Until upgraded, wrap `Sanitizer::sanitize()` calls in a try/catch and treat exceptions as rejected uploads","status":"open","published_at":"2026-10-27T11:17:35+00:00","first_seen_at":"2026-10-27T11:31:28+00:00","triaged_at":"2026-10-27T11:31:54+00:00","updated_at":"2026-10-27T11:31:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T11:31:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the svg-sanitizer package to `1.1.0` or later\n- Until upgraded, wrap `Sanitizer::sanitize()` calls in a try/catch and treat exceptions as rejected uploads","reach":"internet","title":"svg-sanitizer: uncaught exception lets crafted SVG crash upload workers","impact":"low","summary":"The svg-sanitizer library throws a LogicException from Sanitizer::sanitize() when given well-formed XML without a top-level svg root, instead of returning false. An attacker can submit such a file to crash the calling process or skip the upload rejection check.","category":"package","nicknames":[],"who_cares":["php","composer","svg-upload","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Worker process crashes; upload rejection check can be bypassed","analyst_note":"","how_to_check":"- Run `composer show enshrined/svg-sanitizer` (or check composer.lock) and see whether the installed version is at least `1.1.0`\n- Search the codebase for calls to `Sanitizer::sanitize(` and check whether they catch exceptions around them","needs_analyst":false,"not_affected_if":["no-svg-uploads","version-1.1.0-or-later"],"who_is_affected":"Applications that accept user-uploaded SVG files and pass them through svg-sanitizer from 0.11.0 up to but not including 1.1.0. Exposure depends on whether the upload endpoint is reachable by untrusted users and whether a thrown exception takes down the worker or skips the rejection branch. Teams that do not sanitize user SVGs with this library can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000644,"input_tokens":3364,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117541':14A,17A '-2026':13A,16A '0.11.0':77C '1.1.0':79C 'allow':86C 'attack':56B,87C,104C 'bypass':132C 'call':65B 'caller':90C 'caus':118C 'check':72B 'compos':18B 'contain':80C 'craft':7A 'crash':9A,63B,89C,129C 'cve':12A,15A 'document':107C 'element':117C 'except':5A,83C 'fals':54B,128C 'file':61B 'form':42B,95C 'given':39B 'host':23B 'instead':51B,125C 'let':6A 'level':48B,101C 'librari':31B 'logicexcept':34B,124C 'nest':115C 'non':111C 'non-svg':110C 'packag':19B 'php':20B 'process':66B 'reject':71B,134C 'return':53B,127C 'root':50B,103C,113C 'sanit':3A,30B,36B,37B,75C,119C,120C 'self':22B 'self-host':21B 'skip':68B 'submit':58B,92C 'suppli':106C 'svg':2A,8A,25B,29B,49B,74C,102C,112C,116C 'svg-sanit':1A,28B,73C 'svg-upload':24B 'throw':32B,122C 'top':47B,100C 'top-level':46B,99C 'uncaught':4A,82C 'upload':10A,26B,70B,133C 'vulner':84C 'well':41B,94C 'well-form':40B,93C 'without':44B,97C 'worker':11A,130C 'xml':43B,96C","nicknames":[],"mitigations":[],"who_affected":"Applications that accept user-uploaded SVG files and pass them through svg-sanitizer from 0.11.0 up to but not including 1.1.0. Exposure depends on whether the upload endpoint is reachable by untrusted users and whether a thrown exception takes down the worker or skips the rejection branch. Teams that do not sanitize user SVGs with this library can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117541","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117541","severity":null,"published_at":"2026-10-27T11:17:35+00:00","modified_at":"2026-10-27T11:17:35+00:00","first_seen_at":"2026-10-27T11:31:28+00:00","fetched_at":"2026-10-27T11:31:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}