Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-117540— svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop

Quick assessment

Affected
darylldoyle svg-sanitizer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SVG Sanitizer 库在 0.5.3 至 1.1.0 版本（不含 1.1.0）中存在拒绝服务漏洞。该漏洞位于 方法中，在剥离 PHP 标签时会反复对整个输入进行扫描。未认证的攻击者可上传包含大量重叠 PHP 标签开始符和结束符的 SVG 文件，从而迫使系统执行二次复杂度的 操作，导致工作进程 CPU 资源在数分钟内被耗尽。

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-117540

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop
Source: CVE Program / CVE List V5
Vulnerability Description
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
darylldoyle svg-sanitizer 0.5.3 ~ 1.1.0 -

II. Public POCs for CVE-2026-117540

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-117540

请登录查看更多情报信息。

Other References for CVE-2026-117540 (3)

Same Patch Batch · darylldoyle · 2026-10-27 · 3 CVEs total

CVE-2026-117541 5.3 MEDIUM svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()
CVE-2026-117539 3.5 LOW darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass

IV. Related Vulnerabilities

Same product: svg-sanitizer
Same vendor: darylldoyle
Same weakness: CWE-407