CVE-2026-107379 in svg-sanitizer
Summary
by MITRE • 10/08/2026
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attribute name in src/Sanitizer.php. The first removal deletes the explicit attribute, while the DTD default rematerializes the value before the href safety path performs the second removal, which can corrupt libxml state and terminate the PHP worker. An attacker who can submit SVG content to a sanitization endpoint can repeatedly interrupt workers and degrade or exhaust application availability. This issue is fixed in version 1.0.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in savg-sanitizer, specifically prior to version 1.0.0, represents a critical flaw in the handling of Document Type Definitions within SVG XML content processed by PHP applications. As a specialized sanitizer for SVG and XML data, this library is designed to strip potentially malicious elements or attributes from user-supplied markup before it is rendered or stored. However, the implementation contains a logic error related to how default attribute values defined in DTDs are managed during the sanitization process. When an attacker submits a crafted SVG file containing a specific DTD structure with a #FIXED attribute default, the sanitizer fails to account for the dynamic nature of XML defaults versus explicit attributes. This oversight leads to a state corruption issue within the underlying libxml library used by PHP to parse XML documents.
The technical root cause lies in the interaction between the cleanAttributesOnWhitelist function and the DOMElement::removeAttribute method. The vulnerability exploits the behavior where removing an attribute that has a default value defined in the DTD causes the parser to automatically restore or rematerialize that attribute with its default value immediately after removal. In this specific scenario, the sanitizer first removes the explicit instance of the targeted attribute from the document tree. Because the attribute is governed by a #FIXED definition in the associated DTD, libxml instantly reinstates it with the predefined default value. The sanitization logic then proceeds to perform a second removal operation on what it perceives as still being present or relevant data. This sequence of double removal attempts on the same logical entity disrupts the internal state machine of libxml, leading to memory corruption or an unrecoverable error condition that forces the PHP worker process to terminate abruptly.
From an operational perspective, this flaw results in a Denial of Service vulnerability with significant availability implications for any application relying on savg-sanitizer to process user-uploaded SVG images. An attacker does not need authentication or high privileges; they merely need the ability to submit SVG content to any endpoint that utilizes this library for sanitization. By repeatedly sending these crafted payloads, an adversary can systematically crash PHP worker processes. In environments using persistent workers such as those found in modern web servers like Swoole, RoadRunner, or standard FPM setups with long-running processes, each successful exploit attempt consumes a worker slot and requires restart overhead. This allows for efficient resource exhaustion attacks that degrade application performance and ultimately render the service unavailable to legitimate users without requiring complex exploitation techniques or high-volume traffic floods.
This vulnerability aligns with CWE-20 Improper Input Validation as it stems from inadequate handling of structured input data, specifically failing to correctly manage attribute states during sanitization operations. Furthermore, in terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1496 Resource Hijacking or more broadly T1499 Endpoint Denial of Service, where the attacker leverages application logic flaws to disrupt service availability rather than stealing data or executing code directly. The impact is strictly limited to availability due to process termination, but in high-throughput environments, this can cascade into broader system instability if worker limits are reached and new connections cannot be accepted by the web server.
The recommended mitigation for organizations currently using versions of savg-sanitizer prior to 1.0.0 is to upgrade immediately to version 1.0.0 or later, where the logic error in attribute handling has been corrected. The fix ensures that the sanitizer correctly accounts for DTD defaults and prevents the double removal sequence that triggers libxml corruption. Until an upgrade can be performed, organizations should implement strict input validation at the network perimeter using Web Application Firewalls to block SVG files containing suspicious DTD structures or #FIXED attributes. Additionally, configuring PHP-FPM with appropriate restart limits and monitoring worker process health metrics can help mitigate the impact by automatically recycling crashed workers more efficiently, though this is a compensatory control rather than a resolution of the underlying code defect.