CVE-2026-105708— imgproxy SVG svg.go sanitizeElement cross site scripting
Quick assessment
Affected
n/a imgproxy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 imgproxy 4.0.17 及更早版本中发现了一个漏洞。该漏洞影响 SVG 处理组件中的 文件的 函数。通过执行特定操作可导致跨站脚本（XSS）攻击。该攻击可远程发起。相关利用代码已公开，可能被恶意利用。该项目已通过 Issue 报告提前获知此问题，但至今尚未作出回应。
Possible ATT&CK Techniques 2 AI
T1189 · Drive-by Compromise T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105708
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
imgproxy SVG svg.go sanitizeElement cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | imgproxy | 4.0.0 |
cpe:2.3:a:imgproxy:imgproxy:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-105708
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105708
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-105708 (1)
-
CVE-2026-105708 | imgproxy up to 4.0.17 SVG processing/svg/svg.go sanitizeElement cross site scripting (Issue 1708) vdb-entry technical-description
Other References for CVE-2026-105708 (5)
-
-
https://vuldb.com/cve/CVE-2026-105708 third-party-advisory
-
-
https://vuldb.com/submit/992216 third-party-advisory
Same Patch Batch · n/a · 2026-10-06 · 4 CVEs total
| CVE-2026-105571 | 7.3 HIGH | PickMall Lilishop Mobile Binding bindMobile improper authorization |
| CVE-2026-105707 | 5.3 MEDIUM | uptrace user_handler.go Login information exposure |
| CVE-2026-105572 | 4.3 MEDIUM | PickMall Lilishop Buyer Invoice List receipt authorization |
IV. Related Vulnerabilities
Same vendor: n/a
-
CVE-2026-105707
uptrace user_handler.go Login information exposure -
CVE-2026-105572
PickMall Lilishop Buyer Invoice List receipt authorization -
CVE-2026-105571
PickMall Lilishop Mobile Binding bindMobile improper authori -
CVE-2026-105438
O2OA General url ActionUploadExcelWithUrl server-side reques -
CVE-2026-105329
TallCMS PluginManager ThemeManager.php code injection
Same weakness: CWE-79
-
CVE-2026-75962
Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross- -
CVE-2026-39760
WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Script -
CVE-2026-105705
SourceCodester Drug Recommendation System add_drug.php cross -
CVE-2026-105784
Joplin whiteboard card rendering allows CSS injection into a -
CVE-2026-105694
Penpot: Stored XSS via Unsanitised SVG Uploads
V. Comments for CVE-2026-105708
No comments yet