svg-sanitizer: Denial of service via quadratic PHP tag stripping
Summary
svg-sanitizer from 0.5.3 before 1.1.0 is a PHP library that cleans uploaded SVG files. Its PHP tag stripping loop rescans the whole input on every pass, so the processing time grows quadratically with input size. An unauthenticated attacker who can upload an SVG with many overlapping PHP tag openers and closers can exhaust CPU on the web server for seconds to minutes per request. The default configuration is affected.
Affected
- svg-sanitizer (Packagist: enshrined/svg-sanitize) from 0.5.3 before 1.1.0
- Downstream applications and plugins that bundle an affected version
- Versions before 0.5.3: Unknown.
Fixed in
- Upgrade to 1.1.0 or later; 1.1.1 is the recommended target because it fixes a bug that was new in 1.1.0.
Workaround
- No vendor workaround documented.
- If an upgrade must wait, restrict SVG uploads to authenticated users, limit upload size and rate at the web server or WAF, and monitor PHP-FPM worker utilisation.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept or exploit code found; this is provisional.
- The vendor advisory describes a proof of concept with measured timings.
Our recommendation
- Check whether any application or plugin uses svg-sanitizer and which version it bundles.
- Upgrade to 1.1.1 or later, and test uploads, because some inputs are now rejected.
- Until the upgrade is done, restrict SVG uploads to trusted users and limit upload size.
- Monitor CPU and worker usage on the web server for signs of abuse.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-2v7c-jx29-jprp github.com
- svg-sanitizer 1.1.0 release github.com
- svg-sanitizer 1.1.1 release github.com
- Fix commit 9ba9001 github.com
- VulnCheck advisory www.vulncheck.com
- VulDB entry 427140 vuldb.com
- OSV record via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:58.
Original description (NVD)
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes.
NVD references (3)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.