{"id":"CVE-2023-36828","aliases":["EUVD-2023-1981","GHSA-6r5g-cq4q-327g"],"status":"published","title":"Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG","description":"Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00655,"percentile":0.51675,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-07-05T21:30:06Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"Packagist","package":"statamic/cms","fixed_in":["4.10.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"statamic/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"statamic/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0"}]}],"versions":["v3.0.0","v3.0.0-beta.1","v3.0.0-beta.10","v3.0.0-beta.11","v3.0.0-beta.12","v3.0.0-beta.13","v3.0.0-beta.14","v3.0.0-beta.15","v3.0.0-beta.16","v3.0.0-beta.17","v3.0.0-beta.18","v3.0.0-beta.19","v3.0.0-beta.2","v3.0.0-beta.20","v3.0.0-beta.21","v3.0.0-beta.22","v3.0.0-beta.23","v3.0.0-beta.24","v3.0.0-beta.25","v3.0.0-beta.26","v3.0.0-beta.27","v3.0.0-beta.28","v3.0.0-beta.29","v3.0.0-beta.3","v3.0.0-beta.30","v3.0.0-beta.31","v3.0.0-beta.32","v3.0.0-beta.33","v3.0.0-beta.34","v3.0.0-beta.35","v3.0.0-beta.36","v3.0.0-beta.37","v3.0.0-beta.38","v3.0.0-beta.39","v3.0.0-beta.4","v3.0.0-beta.40","v3.0.0-beta.41","v3.0.0-beta.42","v3.0.0-beta.43","v3.0.0-beta.44","v3.0.0-beta.45","v3.0.0-beta.46","v3.0.0-beta.5","v3.0.0-beta.6","v3.0.0-beta.7","v3.0.0-beta.8","v3.0.0-beta.9","v3.0.1","v3.0.10","v3.0.11","v3.0.12","v3.0.13","v3.0.14","v3.0.15","v3.0.16","v3.0.17","v3.0.18","v3.0.19","v3.0.2","v3.0.20","v3.0.21","v3.0.22","v3.0.23","v3.0.24","v3.0.25","v3.0.26","v3.0.27","v3.0.28","v3.0.29","v3.0.3","v3.0.30","v3.0.31","v3.0.32","v3.0.33","v3.0.34","v3.0.35","v3.0.35.1","v3.0.36","v3.0.36.1","v3.0.37","v3.0.38","v3.0.39","v3.0.4","v3.0.40","v3.0.41","v3.0.42","v3.0.43","v3.0.44","v3.0.45","v3.0.46","v3.0.47","v3.0.48","v3.0.49","v3.0.5","v3.0.6","v3.0.7","v3.0.8","v3.0.9","v3.1.0","v3.1.0-alpha.1","v3.1.0-alpha.2","v3.1.0-alpha.3","v3.1.0-alpha.4","v3.1.0-beta.1","v3.1.0-beta.2","v3.1.0-beta.3","v3.1.1","v3.1.10","v3.1.11","v3.1.12","v3.1.13","v3.1.14","v3.1.15","v3.1.16","v3.1.17","v3.1.18","v3.1.19","v3.1.2","v3.1.20","v3.1.21","v3.1.22","v3.1.23","v3.1.24","v3.1.25","v3.1.26","v3.1.27","v3.1.28","v3.1.29","v3.1.3","v3.1.30","v3.1.31","v3.1.32","v3.1.33","v3.1.34","v3.1.35","v3.1.4","v3.1.5","v3.1.6","v3.1.7","v3.1.8","v3.1.9","v3.2.0","v3.2.0-beta.1","v3.2.1","v3.2.10","v3.2.11","v3.2.12","v3.2.13","v3.2.14","v3.2.15","v3.2.16","v3.2.17","v3.2.18","v3.2.19","v3.2.2","v3.2.20","v3.2.21","v3.2.22","v3.2.23","v3.2.24","v3.2.25","v3.2.26","v3.2.27","v3.2.28","v3.2.29","v3.2.3","v3.2.30","v3.2.31","v3.2.32","v3.2.33","v3.2.34","v3.2.35","v3.2.36","v3.2.37","v3.2.38","v3.2.39","v3.2.4","v3.2.5","v3.2.6","v3.2.7","v3.2.8","v3.2.9","v3.3.0","v3.3.0-beta.1","v3.3.0-beta.2","v3.3.0-beta.3","v3.3.0-beta.4","v3.3.0-beta.5","v3.3.0-beta.6","v3.3.0-beta.7","v3.3.1","v3.3.10","v3.3.11","v3.3.12","v3.3.13","v3.3.14","v3.3.15","v3.3.16","v3.3.17","v3.3.18","v3.3.19","v3.3.2","v3.3.20","v3.3.21","v3.3.22","v3.3.23","v3.3.24","v3.3.25","v3.3.26","v3.3.27","v3.3.28","v3.3.29","v3.3.3","v3.3.30","v3.3.31","v3.3.32","v3.3.33","v3.3.34","v3.3.35","v3.3.36","v3.3.37","v3.3.38","v3.3.39","v3.3.4","v3.3.40","v3.3.41","v3.3.42","v3.3.43","v3.3.44","v3.3.45","v3.3.46","v3.3.47","v3.3.48","v3.3.49","v3.3.5","v3.3.50","v3.3.51","v3.3.52","v3.3.53","v3.3.54","v3.3.55","v3.3.56","v3.3.57","v3.3.58","v3.3.59","v3.3.6","v3.3.60","v3.3.61","v3.3.62","v3.3.63","v3.3.64","v3.3.65","v3.3.66","v3.3.67","v3.3.68","v3.3.7","v3.3.8","v3.3.9","v3.4.0","v3.4.1","v3.4.10","v3.4.11","v3.4.12","v3.4.13","v3.4.14","v3.4.15","v3.4.16","v3.4.17","v3.4.2","v3.4.3","v3.4.4","v3.4.5","v3.4.6","v3.4.7","v3.4.8","v3.4.9","v4.0.0","v4.0.0-alpha.1","v4.0.0-alpha.2","v4.0.0-alpha.3","v4.0.0-alpha.4","v4.0.0-alpha.5","v4.0.0-beta.1","v4.0.0-beta.2","v4.0.0-beta.3","v4.0.0-beta.4","v4.1.0","v4.1.1","v4.1.2","v4.1.3","v4.2.0","v4.3.0","v4.4.0","v4.5.0","v4.6.0","v4.7.0","v4.8.0","v4.9.0","v4.9.1","v4.9.2"]}],"products":[{"vendor":"statamic","product":"cms"},{"vendor":"statamic","product":"statamic"}],"references":[{"url":"https://github.com/statamic/cms/security/advisories/GHSA-6r5g-cq4q-327g","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/statamic/cms/pull/8408","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/statamic/cms/commit/c714893ad92de6e5ede17b501003441af505b30d","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Http/Controllers/CP/Fieldtypes/FilesFieldtypeController.php#L15","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Tags/Svg.php#L36-L40","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://github.com/statamic/cms/releases/tag/v4.10.0","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36828","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6r5g-cq4q-327g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36828.json","tags":["advisory"]},{"url":"https://github.com/statamic/cms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-36828","title":"Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG","description":"Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.","status":"published","published":"2023-07-05T21:30:06.196Z","modified":"2024-10-24T18:06:44.25Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:27.810438Z"}],"euvd":[{"id":"EUVD-2023-1981","description":"Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.","status":"published","published":"2023-07-05T21:30:06Z","modified":"2024-10-24T18:06:44Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:05:20.137911Z"}],"ghsa":[{"id":"GHSA-6r5g-cq4q-327g","title":"Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG","description":"Antlers sanitizer cannot effectively sanitize malicious SVG\n\n### Summary\nThe SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform XSS attacks using SVG, even when using the `sanitize` function.\n\n### Details\nRegarding the previous discussion mentioned [here](https://github.com/statamic/cms/security/advisories/GHSA-jvw9-rrc5-39g6#advisory-comment-84322), it has been identified that the default blacklist in the **FilesFieldtypeController** (located at this [link](https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Http/Controllers/CP/Fieldtypes/FilesFieldtypeController.php#L15)) only blocks certain file extensions such as php, php3, php4, php5, and phtml. This allows a malicious user to upload a manipulated SVG file disguised as a social media icon, potentially triggering an XSS vulnerability.\n\n### PoC Screenshot\n![image](https://user-images.githubusercontent.com/17494868/251093022-15f949e9-2014-4069-850b-81940076745e.png)\n\n### PoC\n1. Create new Global set, let's say \"Settings\"\n2. Create a \"Grid\" field in Blueprint (named: social), then add somefields Name (text), URL (text) and Icon (Assets) in the section Fields.\n3. When calling the social setting in the `_footer.antlers.html`, remember to [sanitize](https://statamic.dev/modifiers/sanitize)\n```\n{{ settings:social }}\n    \u003ca href=\"{{ $url }}\" class=\"ml-4\" aria-label=\"{{ $name }}\" rel=\"noopener\"\u003e\n        {{ svg :src=\"icon\" class=\"h-6 w-6 hover:text-hot-pink\" | sanitize }}\n    \u003c/a\u003e\n{{ /settings:social }}\n```\n4. Upload the malicious SVG image, here is the code:\n```\n\u003c?xml version=\"1.0\" standalone=\"no\"?\u003e\n\u003c!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"\u003e\n\n\u003csvg width=\"500\" height=\"500\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\"\u003e\n   \u003ctext x=\"20\" y=\"35\"\u003eStatamic\u003c/text\u003e\n   \u003cforeignObject width=\"500\" height=\"500\"\u003e\n            \u003ciframe xmlns=\"http://www.w3.org/1999/xhtml\" src=\"javascript:confirm(document.cookie);\" width=\"400\" height=\"250\"/\u003e\n   \u003c/foreignObject\u003e\n\u003c/svg\u003e\n```\n\n\n\n### Impact\nSince the social media icon is displayed in the footer layout, any user can view it, potentially leading to the execution of XSS.\n\n### Suggestions to Mitigate or Resolve the Issue:\nSanitize when outputing the svg. This vulnerability caused by unsanitized `File::get()` when retrieving the SVG, it is crucial to sanitize the SVG when outputting it. The issue can be found in the following file: https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Tags/Svg.php#L36-L40.\n\nIt is highly recommended to implement proper sanitization measures to ensure the security of the SVG content. One effective approach is to utilize a reliable package, such as https://github.com/darylldoyle/svg-sanitizer ,which provides comprehensive SVG sanitization capabilities.\n\nSo the code becomes:\n```php\nuse enshrined\\svgSanitize\\Sanitizer;\n\nif (File::exists($file)) {\n                \n    $sanitizer = new Sanitizer();\n    $dirtySVG = File::get($file);\n\n    $svg = $sanitizer-\u003esanitize($dirtySVG);\n    break;\n}\n```\n\n### Reference\n- https://github.com/gogs/gogs/security/advisories/GHSA-ff28-f46g-r9g8\n- https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d/\n- https://blog.nintechnet.com/wordpress-elementor-plugin-fixed-svg-xss-protection-bypass-vulnerability/","status":"published","published":"2023-07-06T20:56:28Z","modified":"2023-11-10T05:02:00Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:18.40412Z"}],"nvd":[{"id":"CVE-2023-36828","description":"Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.","status":"published","published":"2023-07-05T22:15:10.113Z","modified":"2026-06-17T06:07:09.877Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:15.127597Z"}],"osv":[{"id":"CVE-2023-36828","title":"Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG","description":"Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.","status":"published","published":"2023-07-05T21:30:06.196Z","modified":"2026-10-28T02:30:35.886294957Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"GHSA-6r5g-cq4q-327g","title":"Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG","description":"Antlers sanitizer cannot effectively sanitize malicious SVG\n\n### Summary\nThe SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform XSS attacks using SVG, even when using the `sanitize` function.\n\n### Details\nRegarding the previous discussion mentioned [here](https://github.com/statamic/cms/security/advisories/GHSA-jvw9-rrc5-39g6#advisory-comment-84322), it has been identified that the default blacklist in the **FilesFieldtypeController** (located at this [link](https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Http/Controllers/CP/Fieldtypes/FilesFieldtypeController.php#L15)) only blocks certain file extensions such as php, php3, php4, php5, and phtml. This allows a malicious user to upload a manipulated SVG file disguised as a social media icon, potentially triggering an XSS vulnerability.\n\n### PoC Screenshot\n![image](https://user-images.githubusercontent.com/17494868/251093022-15f949e9-2014-4069-850b-81940076745e.png)\n\n### PoC\n1. Create new Global set, let's say \"Settings\"\n2. Create a \"Grid\" field in Blueprint (named: social), then add somefields Name (text), URL (text) and Icon (Assets) in the section Fields.\n3. When calling the social setting in the `_footer.antlers.html`, remember to [sanitize](https://statamic.dev/modifiers/sanitize)\n```\n{{ settings:social }}\n    \u003ca href=\"{{ $url }}\" class=\"ml-4\" aria-label=\"{{ $name }}\" rel=\"noopener\"\u003e\n        {{ svg :src=\"icon\" class=\"h-6 w-6 hover:text-hot-pink\" | sanitize }}\n    \u003c/a\u003e\n{{ /settings:social }}\n```\n4. Upload the malicious SVG image, here is the code:\n```\n\u003c?xml version=\"1.0\" standalone=\"no\"?\u003e\n\u003c!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"\u003e\n\n\u003csvg width=\"500\" height=\"500\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\"\u003e\n   \u003ctext x=\"20\" y=\"35\"\u003eStatamic\u003c/text\u003e\n   \u003cforeignObject width=\"500\" height=\"500\"\u003e\n            \u003ciframe xmlns=\"http://www.w3.org/1999/xhtml\" src=\"javascript:confirm(document.cookie);\" width=\"400\" height=\"250\"/\u003e\n   \u003c/foreignObject\u003e\n\u003c/svg\u003e\n```\n\n\n\n### Impact\nSince the social media icon is displayed in the footer layout, any user can view it, potentially leading to the execution of XSS.\n\n### Suggestions to Mitigate or Resolve the Issue:\nSanitize when outputing the svg. This vulnerability caused by unsanitized `File::get()` when retrieving the SVG, it is crucial to sanitize the SVG when outputting it. The issue can be found in the following file: https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Tags/Svg.php#L36-L40.\n\nIt is highly recommended to implement proper sanitization measures to ensure the security of the SVG content. One effective approach is to utilize a reliable package, such as https://github.com/darylldoyle/svg-sanitizer ,which provides comprehensive SVG sanitization capabilities.\n\nSo the code becomes:\n```php\nuse enshrined\\svgSanitize\\Sanitizer;\n\nif (File::exists($file)) {\n                \n    $sanitizer = new Sanitizer();\n    $dirtySVG = File::get($file);\n\n    $svg = $sanitizer-\u003esanitize($dirtySVG);\n    break;\n}\n```\n\n### Reference\n- https://github.com/gogs/gogs/security/advisories/GHSA-ff28-f46g-r9g8\n- https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d/\n- https://blog.nintechnet.com/wordpress-elementor-plugin-fixed-svg-xss-protection-bypass-vulnerability/","status":"published","published":"2023-07-06T20:56:28Z","modified":"2026-09-10T03:49:54.361852482Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:39.965326Z"}]}}