Is CVE-2026-105708 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105708 being exploited in the wild.

How severe is CVE-2026-105708?

Medium severity, with a CVSS score of 4.3, published 6 October 2026.

How is CVE-2026-105708 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-105708?

Check whether you run Imgproxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105708: imgproxy SVG handler cross-site scripting in sanitization

CVE-2026-105708 · Severity: medium · CVSS 4.3 · Published 2026-10-06

imgproxy is a server that processes and resizes images on demand. A flaw in its SVG sanitizer allows attackers to inject malicious external resource references in SVG files, which will be loaded by browsers when viewing the processed image, potentially leading to data theft or malware distribution. The vulnerability affects versions up to 4.0.17 and can be exploited remotely without authentication.

Technologies: Imgproxy. Vendors: Imgproxy.

Quick answers

Is CVE-2026-105708 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105708 being exploited in the wild.
How severe is CVE-2026-105708?: Medium severity, with a CVSS score of 4.3, published 6 October 2026.
Which products and versions are affected?: Imgproxy up to 4.0.17.
Is there a fix for CVE-2026-105708?: No fixed version is recorded yet. Set IMGPROXY_SANITIZE_SVG=false if SVG processing is not required, or restrict access to imgproxy to trusted networks only until a patched version is available. Additionally, configure stricter CSP headers such as default-src 'none'; img-src 'none'; style-src 'none' to provide defense in depth. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105708 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-105708?: Check whether you run Imgproxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Set IMGPROXY_SANITIZE_SVG=false if SVG processing is not required, or restrict access to imgproxy to trusted networks only until a patched version is available. Additionally, configure stricter CSP headers such as default-src 'none'; img-src 'none'; style-src 'none' to provide defense in depth.

Technical details

The SVG sanitizer in imgproxy's processing/svg/svg.go function sanitizeElement incompletely removes external resource references; it strips script tags and on* attributes but fails to neutralize CSS @import and url() directives, SVG image href attributes, and feImage elements. When imgproxy serves the sanitized SVG with inline Content-Disposition, browsers fetch these attacker-controlled URLs despite the script-src 'none' CSP header. An unauthenticated remote attacker can craft an SVG with embedded external references to trigger unwanted requests and potentially exfiltrate sensitive data.

Affected products

imgproxy imgproxy up to 4.0.17

Timeline

2026-06-13: disclosed
2026-10-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.