Improper Input Validation in PHP SVG/XML Sanitizer by Daryldoyle

CVE-2026-107380

What is CVE-2026-107380?

A vulnerability in the SVG sanitizer by Daryldoyle allows for improper input validation, where an attacker can craft an SVG entity that exploits a flaw in the isHrefSafeValue() function. This issue arises from the handling of XML DTD entity expansion, permitting malicious user input to be processed as safe, while the actual rendering in HTML5 allows for execution of arbitrary scripts. This risk is particularly heightened when sanitized SVGs are embedded inline within applications. The vulnerability has been addressed in version 1.0.0 of the sanitizer.

References