CVE-2026-117540
Deferred Deferred - Pending Action

SVG Sanitizer Denial of Service via PHP Tag Overlapping

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-117540
EUVD
EUVD-2026-110805

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
darylldoyle svg-sanitizer 0.5.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in the svg-sanitizer library versions 0.5.3 to 1.1.0. It occurs in the Sanitizer::sanitize() function where PHP tags are stripped from input SVGs. Attackers can upload specially crafted SVGs with many overlapping PHP tag openers and closers, causing the sanitizer to repeatedly rescan the entire input during processing. This creates a quadratic increase in CPU usage, exhausting server resources for extended periods.

Detection Guidance

Check svg-sanitizer version with composer show darylldoyle/svg-sanitizer. If version is below 1.1.0, the system is vulnerable. Monitor for high CPU usage during SVG processing or unusual network traffic from SVG uploads.

Impact Analysis

Unauthenticated attackers can exploit this to cause severe performance degradation or complete denial of service on servers using affected svg-sanitizer versions. This may lead to service outages, degraded performance, or system crashes. The attack requires only uploading a malicious SVG file and can affect systems processing user-uploaded content.

Mitigation Strategies

Upgrade svg-sanitizer to version 1.1.0 or later immediately. If upgrading is not possible, implement input length limits for SVG uploads and add rate limiting to prevent abuse. Disable PHP tag stripping in sanitizer configuration if feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117540. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart