Vulnerability in PHP SVG Sanitizer by Daryl Doyle

CVE-2026-107381

What is CVE-2026-107381?

The SVG Sanitizer by Daryl Doyle contains a vulnerability where the Resolver::processReferences() method fails to normalize mixed-case href attributes, allowing attackers to craft malicious nested elements. By exploiting a case-sensitive href attribute, specifically using 'xlink:HrEf', the sanitization process omits critical use nesting protection limits. Consequently, this flaw can lead to resource exhaustion issues in applications that render the sanitized SVG files if they do not implement adequate safeguards. This vulnerability has been addressed in version 1.0.0 of the SVG Sanitizer.

References