---
id: "CVE-2026-117541"
kind: "vulnerability"
aliases: ["CVE-2026-117541"]
title: "svg-sanitizer: uncaught exception lets crafted SVG crash upload workers"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["composer", "package", "php", "self-hosted", "svg-upload"]
not_affected_if: ["no-svg-uploads", "version-1.1.0-or-later"]
published_at: "2026-10-27T11:17:35+00:00"
first_seen_at: "2026-10-27T11:31:28+00:00"
updated_at: "2026-10-27T11:31:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117541", "first_seen_at": "2026-10-27T11:31:28+00:00"}]
---

# svg-sanitizer: uncaught exception lets crafted SVG crash upload workers

The svg-sanitizer library throws a LogicException from Sanitizer::sanitize() when given well-formed XML without a top-level svg root, instead of returning false. An attacker can submit such a file to crash the calling process or skip the upload rejection check.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `composer show enshrined/svg-sanitizer` (or check composer.lock) and see whether the installed version is at least `1.1.0`
- Search the codebase for calls to `Sanitizer::sanitize(` and check whether they catch exceptions around them

## Fix

- Upgrade the svg-sanitizer package to `1.1.0` or later
- Until upgraded, wrap `Sanitizer::sanitize()` calls in a try/catch and treat exceptions as rejected uploads

## Timeline

- 2026-10-27T11:31:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117541

## From the sources

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize() to throw a LogicException instead of returning false, crashing workers or bypassing upload rejection.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_