DoS via DTD Attribute Declaration Crash in enshrined/svg-sanitize

Vulnerability Overview Vulnerability Name: enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash Vulnerability Description: A maliciously crafted SVG file (1,009 bytes) causes a PHP process crash when sanitized using (any version up to 0.22.x). The sanitizer's method calls twice: first to remove explicit attributes, and then to attempt removing DTD default values. This triggers a type confusion bug in PHP's extension, resulting in the crash of the PHP-FPM worker process. Impact Scope Affected Packages: - : 45.2M Packagist downloads, 1.3M/month, 90+ dependencies - WordPress Safe SVG plugin: 1M+ active installations - TYPO3: integrated into the core since v9 - Drupal: Community modules wrapping CVSS Score: 6.5 (Medium) Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High Remediation Recommended Fix: Strip the before parsing, which eliminates the trigger condition regardless of the PHP version. Proof of Concept Code Malicious SVG (evil.svg) Independent Reproduction WordPress Reproduction 1. WordPress (any version) + Safe SVG plugin (any version up to 2.4.0) 2. Log in as Author - Media - Add New - Upload 3. Result: HTTP 502 Bad Gateway, PHP-FPM worker process crash Confirmation Output Impact Complete Site Denial of Service When , N concurrent SVG uploads + death of all PHP-FPM worker processes = total downtime. Worker processes will restart, but each malicious request kills one. An auto-restart loop maintains a permanent DoS state. Application State Corruption bypasses . In WordPress + WooCommerce: - Coupon Bypass: Usage count increment is skipped - infinite reuse of one-time coupons - Inventory Overselling: Inventory decrement is not committed - multiple orders placed for 1 inventory item - Scheduled Task Starvation: is blocked - scheduled cleanups (uncancelled orders) never run - inventory held indefinitely Attack Surface Safe SVG hooks into (safe-svg.php line 152). The hook triggers when or is called. Note: Popular form plugins (Contact Form 7, WPForms) use to bypass WordPress's upload pipeline directly. They do not trigger Safe SVG. Only code that explicitly calls is affected. The most potent pre-authentication scenario is custom PHP applications that directly use on public upload endpoints - a common pattern given the 45M+ Packagist downloads and 90+ dependent packages. CVSS CVSS 3.1: 6.5 (Medium) - Default WordPress (Author role) For custom applications with unauthenticated endpoints: CVSS 7.5 (High) (PR:N) Environment 0.22.x (bundled with Safe SVG 2.4.0) WordPress 6.9.4 + Safe SVG 2.4.0 PHP 8.3.24 (php-fpm, NTS, x86_64) nginx + PHP-FPM (Docker) Reported by ExPatch Security Research - expatch.llc Denis Rostovtsev

Goal Reached Thanks to every supporter — we hit 100%!

DoS via DTD Attribute Declaration Crash in enshrined/svg-sanitize

More from this source