Junglewise Threat Intelligence

CVE-2024-25117: php-svg-lib lacks path validation on font through SVG inline styles

CVE-2024-25117 · Severity: low · CVSS 3.1 · Published 2024-02-21

Technologies: phenx/php-svg-lib (Packagist). Vendors: Packagist.

Executive brief

php-svg-lib lacks path validation on font through SVG inline styles

Affected products

Packagist phenx/php-svg-lib

Related threats

Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE
Denial of service caused by infinite recursion when parsing SVG document