DOM/SVG Sanitization Flaws in DOMSanitizer for PHP by Rhukster

CVE-2026-40301

What is CVE-2026-40301?

The DOMSanitizer is a PHP library designed to provide security against potential threats emanating from SVG content. However, prior to version 1.0.10, it permits elements within SVG content without scrutinizing their accompanying text. This oversight allows malicious CSS constructs such as url() references and @import rules to bypass filtering, which can lead to vulnerable browsers making HTTP requests to potentially harmful external servers upon rendering the sanitized SVG. The development team has since addressed this issue and released an updated version to enhance security.

References