Is CVE-2026-107379 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107379 being exploited in the wild.

How severe is CVE-2026-107379?

Medium severity, with a CVSS score of 6.5, published 8 October 2026.

Which products and versions are affected?

Drupal community Drupal community module versions using svg-sanitize; Enshrined Svg-Sanitize all versions through 0.22.x; enshrined/svg-sanitize (Packagist) <= 0.22.0, ECOSYSTEM:introduced=0,fixed=1.0.0; Typo3 v9 and later (integrated in core); and 1 more.

Is there a fix for CVE-2026-107379?

Yes. enshrined/svg-sanitize (Packagist): upgrade to 1.0.0 or later. Until then: Strip DOCTYPE and DTD declarations from SVG input before parsing: use a regex like `/ ]*(?:\[.*?\])?\s*>/si` to remove them prior to DOMDocument::loadXML(). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107379 attacked?

It is attacked over the network.

Am I affected by CVE-2026-107379?

Check whether you run Drupal community Drupal, Enshrined Svg-Sanitize, enshrined/svg-sanitize (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107379: enshrined svg-sanitize denial of service via DTD attribute declaration

Q: Is there a fix for CVE-2026-107379?

Yes. enshrined/svg-sanitize (Packagist): upgrade to 1.0.0 or later. Until then: Strip DOCTYPE and DTD declarations from SVG input before parsing: use a regex like `/ ]*(?:\[.*?\])?\s*>/si` to remove them prior to DOMDocument::loadXML(). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-107379 · Severity: medium · CVSS 6.5 · Published 2026-10-08

The svg-sanitize library, used by WordPress Safe SVG and integrated into TYPO3 and Drupal, crashes when processing specially crafted SVG files containing DTD declarations. An attacker who can upload SVG files (typically requiring author or editor credentials in WordPress) can trigger a PHP process crash, leading to site outages or allowing commodity fraud by bypassing order processing controls like coupon limits and stock reduction.

Technologies: enshrined/svg-sanitize (Packagist), Typo3. Vendors: Enshrined, Packagist, Typo3.

Quick answers

Is CVE-2026-107379 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107379 being exploited in the wild.
How severe is CVE-2026-107379?: Medium severity, with a CVSS score of 6.5, published 8 October 2026.
Which products and versions are affected?: Drupal community Drupal community module versions using svg-sanitize; Enshrined Svg-Sanitize all versions through 0.22.x; enshrined/svg-sanitize (Packagist) <= 0.22.0, ECOSYSTEM:introduced=0,fixed=1.0.0; Typo3 v9 and later (integrated in core); and 1 more.
Is there a fix for CVE-2026-107379?: Yes. enshrined/svg-sanitize (Packagist): upgrade to 1.0.0 or later. Until then: Strip DOCTYPE and DTD declarations from SVG input before parsing: use a regex like `/<!DOCTYPE[^>]*(?:\[.*?\])?\s*>/si` to remove them prior to DOMDocument::loadXML().</anigation> <parameter name="fixed_in"><UNKNOWN> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107379 attacked?: It is attacked over the network.
Am I affected by CVE-2026-107379?: Check whether you run Drupal community Drupal, Enshrined Svg-Sanitize, enshrined/svg-sanitize (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

enshrined/svg-sanitize (Packagist): upgrade to 1.0.0 or later
```
composer require enshrined/svg-sanitize:^1.0.0
```

Strip DOCTYPE and DTD declarations from SVG input before parsing: use a regex like `/<!DOCTYPE[^>]*(?:\[.*?\])?\s*>/si` to remove them prior to DOMDocument::loadXML().</anigation> <parameter name="fixed_in"><UNKNOWN>

Technical details

The sanitizer's cleanAttributesOnWhitelist() method calls DOMElement::removeAttribute() twice on attributes with DTD #FIXED defaults — first to remove the explicit attribute, then attempting to remove the DTD declaration — triggering a PHP ext/dom type confusion that aborts the worker process. Attack vector is network, requires SVG upload capability (Author role or higher in WordPress, or unauthenticated in custom applications). A fix exists: strip DOCTYPE/DTD declarations before XML parsing.

Affected products

enshrined svg-sanitize 0.22.x and earlier
enshrined svg-sanitize all versions through 0.22.x
Wordpress community Safe SVG through 2.4.0
TYPO3 TYPO3 v9 and later (integrated in core)
Drupal community Drupal community module versions using svg-sanitize

Identifiers

CVE-2026-107379
GHSA-v383-3rw5-q8rf

Timeline

2026-10-08: disclosed: Advisory published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.