Read the docs
TI-2024-16571 Aliases CVE-2024-25117GHSA-f3qr-qr4x-j273

php-svg-lib lacks path validation on font through SVG inline styles

Priority HIGH 76CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate if external references are allowed. This might leads to bypass of restrictions or RCE on projects that are using it, if they do not strictly revalidate the fontName that is passed by php-svg-lib. The `Style::fromAttributes(`), or the `Style::parseCssStyle()` should check the content of the `font-family` and prevents it to use a PHAR url, to avoid passing an invalid and dangerous `fontName` value to other libraries. The same check as done in the `Style::fromStyleSheets` might be reused. Libraries using this library as a dependency might be vulnerable to some bypass of restrictions, or even remote code execution, if they do not double check the value of the `fontName` that is passed by php-svg-lib. Version 0.5.2 contains a fix for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00932 60th percentileScored 2026-11-07
Fix Fixed php-svg-lib (dompdf): 0.5.2phenx/php-svg-lib (Packagist): 0.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dompdfphp-svg-libbefore 0.5.20.5.2Patch availableCNA
—phenx/php-svg-lib (Packagist)before 0.5.20.5.2Patch availableGHSA-f3qr-qr4x-j273
  • php-svg-lib Vendordompdf Affected before 0.5.2 Fixed in 0.5.2 Patch available CNA
  • phenx/php-svg-lib (Packagist) Vendor— Affected before 0.5.2 Fixed in 0.5.2 Patch available GHSA-f3qr-qr4x-j273

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:dompdf:php-svg-lib:*:*:*:*:*:*:*:*before 0.5.2Vulnerabledompdf
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*before 8.0.0Running onPHP
  • cpe:2.3:a:dompdf:php-svg-lib:*:*:*:*:*:*:*:* Versions before 0.5.2 Vulnerable ·dompdf
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions before 8.0.0 Running on ·PHP

Remediation

  • Fix · CNA php-svg-lib (dompdf) Fixed in 0.5.2
  • Fix · GHSA-f3qr-qr4x-j273 phenx/php-svg-lib (Packagist) Fixed in 0.5.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25117
  2. 2026-10-03 Alias added: GHSA-f3qr-qr4x-j273

References

Patch 2

Advisory 2

Other 1

  • TI-2023-27479 php-svg-lib possible DoS caused by infinite recursion when parsing SVG document CVSS 3.1HIGH 7.5
  • TI-2023-27480 php-svg-lib unsafe attributes merge when parsing `use` tag CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences