Denial of Service Vulnerability in svg-sanitizer by Daryll Doyle

CVE-2026-117540

What is CVE-2026-117540?

The svg-sanitizer, maintained by Daryll Doyle, is susceptible to a denial of service vulnerability due to inefficient PHP tag handling in the Sanitizer::sanitize() function. Attackers can exploit this flaw by uploading specially crafted SVG files with overlapping PHP tag openings and closures. This leads to extensive CPU resource exhaustion as the system engages in repeated rescans and replacements, causing significant delays and potential service interruptions. It is crucial for users to update to version 1.1.0 or later to mitigate this issue.

References