{"id":"CVE-2025-55166","aliases":["CLSA-2026-1787820940","EUVD-2025-24263","GHSA-22wq-q86m-83fh"],"status":"published","title":"svg-sanitizer By-Passing Attribute Sanitization","description":"savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute name, which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripting or linking to external domains. This issue has been patched in version 0.22.0.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00544,"percentile":0.45964,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601","CWE-79"],"published":"2025-08-12T16:25:17Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"Packagist","package":"enshrined/svg-sanitize","fixed_in":["0.22.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"enshrined/svg-sanitize","fixed_in":["0.16.0-p1+tuxcare"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"enshrined/svg-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"enshrined/svg-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.16.0"},{"fixed":"0.16.0-p1+tuxcare"}]}],"versions":["0.16.0"]},{"source":"osv","ecosystem":"Packagist","package":"enshrined/svg-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.10.0","0.11.0","0.12.0","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.4","0.16.0","0.17.0","0.18.0","0.19.0","0.2.0","0.2.1","0.20.0","0.21.0","0.3.0","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.5.3","0.5.3.1","0.6.0","0.7.0","0.7.1","0.7.2","0.8.0","0.8.1","0.8.2","0.9.0","0.9.1","0.9.2"]}],"products":[{"vendor":"darylldoyle","product":"svg-sanitizer"}],"references":[{"url":"https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-22wq-q86m-83fh","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/darylldoyle/svg-sanitizer/commit/5a0a1eaf0c6b0b540dc945fe30c93cf106b357c1","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55166","tags":["advisory"]},{"url":"https://github.com/darylldoyle/svg-sanitizer/commit/0afa95ea74be155a7bcd6c6fb60c276c39984500","tags":["web"]},{"url":"https://github.com/darylldoyle/svg-sanitizer/blob/0.21.0/src/Sanitizer.php#L454-L481","tags":["web"]},{"url":"https://github.com/darylldoyle/svg-sanitizer/releases/tag/0.22.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-22wq-q86m-83fh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55166.json","tags":["advisory"]},{"url":"https://github.com/darylldoyle/svg-sanitizer","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-55166","title":"svg-sanitizer By-Passing Attribute Sanitization","description":"savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute name, which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripting or linking to external domains. This issue has been patched in version 0.22.0.","status":"published","published":"2025-08-12T16:25:17.22Z","modified":"2025-08-12T17:48:05Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79","CWE-601"],"updated_at":"2026-11-02T14:32:52.839698Z"}],"euvd":[{"id":"EUVD-2025-24263","description":"savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute name, which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripting or linking to external domains. This issue has been patched in version 0.22.0.","status":"published","published":"2025-08-12T16:25:17Z","modified":"2025-08-12T17:48:05Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:31:58.846249Z"}],"ghsa":[{"id":"GHSA-22wq-q86m-83fh","title":"svg-sanitizer Bypasses Attribute Sanitization","description":"#### Problem\n\nThe sanitization logic at https://github.com/darylldoyle/svg-sanitizer/blob/0.21.0/src/Sanitizer.php#L454-L481 only searches for lower-case attribute names (e.g. `xlink:href` instead of `xlink:HrEf`), which allows to by-pass the `isHrefSafeValue` check. As a result this allows cross-site scripting or linking to external domains.\n\n#### Proof-of-concept\n_provided by azizk_\n\n```\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" width=\"100\" height=\"100\"\u003e\n  \u003ca xlink:hReF=\"javascript:alert(document.domain)\"\u003e\n    \u003crect width=\"100\" height=\"50\" fill=\"red\"\u003e\u003c/rect\u003e\n    \u003ctext x=\"50\" y=\"30\" text-anchor=\"middle\" fill=\"white\"\u003eClick me\u003c/text\u003e\n  \u003c/a\u003e\n\u003c/svg\u003e\n```\n\n#### Credits\n\nThe mentioned findings and proof-of-concept example were reported to the TYPO3 Security Team by the external security researcher `azizk \u003cmedazizknani@gmail.com\u003e`.","status":"published","published":"2025-08-12T20:20:58Z","modified":"2025-08-12T20:21:00Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-79","CWE-601"],"updated_at":"2026-11-02T14:38:53.767052Z"}],"nvd":[{"id":"CVE-2025-55166","description":"savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute name, which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripting or linking to external domains. This issue has been patched in version 0.22.0.","status":"published","published":"2025-08-12T17:15:39.667Z","modified":"2026-06-17T09:41:23.383Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-79","CWE-601"],"updated_at":"2026-11-02T14:11:22.953396Z"}],"osv":[{"id":"CVE-2025-55166","title":"svg-sanitizer By-Passing Attribute Sanitization","description":"savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute name, which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripting or linking to external domains. This issue has been patched in version 0.22.0.","status":"published","published":"2025-08-12T16:25:17.22Z","modified":"2026-10-28T02:30:29.021663532Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-601","CWE-79"],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"GHSA-22wq-q86m-83fh","title":"svg-sanitizer Bypasses Attribute Sanitization","description":"#### Problem\n\nThe sanitization logic at https://github.com/darylldoyle/svg-sanitizer/blob/0.21.0/src/Sanitizer.php#L454-L481 only searches for lower-case attribute names (e.g. `xlink:href` instead of `xlink:HrEf`), which allows to by-pass the `isHrefSafeValue` check. As a result this allows cross-site scripting or linking to external domains.\n\n#### Proof-of-concept\n_provided by azizk_\n\n```\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" width=\"100\" height=\"100\"\u003e\n  \u003ca xlink:hReF=\"javascript:alert(document.domain)\"\u003e\n    \u003crect width=\"100\" height=\"50\" fill=\"red\"\u003e\u003c/rect\u003e\n    \u003ctext x=\"50\" y=\"30\" text-anchor=\"middle\" fill=\"white\"\u003eClick me\u003c/text\u003e\n  \u003c/a\u003e\n\u003c/svg\u003e\n```\n\n#### Credits\n\nThe mentioned findings and proof-of-concept example were reported to the TYPO3 Security Team by the external security researcher `azizk \u003cmedazizknani@gmail.com\u003e`.","status":"published","published":"2025-08-12T20:20:58Z","modified":"2025-08-12T20:42:20.247581Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-601","CWE-79"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"CLSA-2026-1787820940","title":"TuxCare security update for enshrined/svg-sanitize (1 CVE)","description":"TuxCare rebuilt enshrined/svg-sanitize to address 1 CVE. Fixed in 0.16.0-p1+tuxcare.","status":"published","published":"2026-08-27T08:55:40Z","modified":"2026-10-15T09:48:00.490208826Z","updated_at":"2026-11-02T15:43:47.591214Z"}]}}