php-svg-lib unsafe attributes merge when parsing `use` tag
Priority MEDIUM 63CWE-15Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-502.
Summary
php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when the `href` attribute from the `<use>` tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue.
Why it matters now
EPSS 0.23903 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed php-svg-lib (dompdf): 0.5.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
- Fix · CNA php-svg-lib (dompdf) Fixed in 0.5.1
Timeline
- 2026-10-02 Threatist record created from CVE-2023-50252
References
More dompdf Php-svg-lib vulnerabilities
- TI-2024-16571 php-svg-lib lacks path validation on font through SVG inline styles CVSS 3.1CRITICAL 9.8
- TI-2023-27479 php-svg-lib possible DoS caused by infinite recursion when parsing SVG document CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences