# CVE-2026-107379: enshrined svg-sanitize denial of service via DTD attribute declaration

Source: https://junglewise.ai/threats/cve-2026-107379-enshrined-svg-sanitize-denial-of-service-via-dtd-attribute  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107379 · Severity: medium · CVSS 6.5 · Published 2026-10-08

The svg-sanitize library, used by WordPress Safe SVG and integrated into TYPO3 and Drupal, crashes when processing specially crafted SVG files containing DTD declarations. An attacker who can upload SVG files (typically requiring author or editor credentials in WordPress) can trigger a PHP process crash, leading to site outages or allowing commodity fraud by bypassing order processing controls like coupon limits and stock reduction.

Technologies: [enshrined/svg-sanitize (Packagist)](https://junglewise.ai/threats/technologies/enshrined-svg-sanitize), [Typo3](https://junglewise.ai/threats/technologies/typo3). Vendors: [Enshrined](https://junglewise.ai/threats/vendors/enshrined), [Packagist](https://junglewise.ai/threats/vendors/packagist), [Typo3](https://junglewise.ai/threats/vendors/typo3).

## Quick answers

**Is CVE-2026-107379 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107379 being exploited in the wild.

**How severe is CVE-2026-107379?** Medium severity, with a CVSS score of 6.5, published 8 October 2026.

**Which products and versions are affected?** Drupal community Drupal community module versions using svg-sanitize; Enshrined Svg-Sanitize all versions through 0.22.x; enshrined/svg-sanitize (Packagist) <= 0.22.0, ECOSYSTEM:introduced=0,fixed=1.0.0; Typo3 v9 and later (integrated in core); and 1 more.

**Is there a fix for CVE-2026-107379?** Yes. enshrined/svg-sanitize (Packagist): upgrade to 1.0.0 or later. Until then: Strip DOCTYPE and DTD declarations from SVG input before parsing: use a regex like `/<!DOCTYPE[^>]*(?:\[.*?\])?\s*>/si` to remove them prior to DOMDocument::loadXML().</anigation>
<parameter name="fixed_in"><UNKNOWN> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107379 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-107379?** Check whether you run Drupal community Drupal, Enshrined Svg-Sanitize, enshrined/svg-sanitize (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- enshrined/svg-sanitize (Packagist): upgrade to 1.0.0 or later

  ```sh
  composer require enshrined/svg-sanitize:^1.0.0
  ```


Strip DOCTYPE and DTD declarations from SVG input before parsing: use a regex like `/<!DOCTYPE[^>]*(?:\[.*?\])?\s*>/si` to remove them prior to DOMDocument::loadXML().</anigation>
<parameter name="fixed_in"><UNKNOWN>

## Technical details

The sanitizer's cleanAttributesOnWhitelist() method calls DOMElement::removeAttribute() twice on attributes with DTD #FIXED defaults — first to remove the explicit attribute, then attempting to remove the DTD declaration — triggering a PHP ext/dom type confusion that aborts the worker process. Attack vector is network, requires SVG upload capability (Author role or higher in WordPress, or unauthenticated in custom applications). A fix exists: strip DOCTYPE/DTD declarations before XML parsing.

## Affected products

- enshrined svg-sanitize 0.22.x and earlier
- enshrined svg-sanitize all versions through 0.22.x
- Wordpress community Safe SVG through 2.4.0
- TYPO3 TYPO3 v9 and later (integrated in core)
- Drupal community Drupal community module versions using svg-sanitize

## Identifiers

- CVE-2026-107379
- GHSA-v383-3rw5-q8rf

## Timeline

- 2026-10-08: disclosed: Advisory published

## Related threats

- [svg-sanitizer case-insensitive xlink:href DoS bypass](https://junglewise.ai/threats/cve-2026-107381-svg-sanitizer-mixed-case-xlink-href-skips-the-use-nesting-dos)
- [enshrined svg-sanitize stored XSS via DTD entity collision](https://junglewise.ai/threats/cve-2026-107380-enshrined-svg-sanitize-stored-xss-via-dtd-entity-html5-named)
- [TYPO3 Direct Mail configuration injection in backend module](https://junglewise.ai/threats/cve-2023-50461-typo3-direct-mail-configuration-injection-in-backend-module)
- [TYPO3 CMS Stores Cleartext Password in User Settings Module](https://junglewise.ai/threats/cve-2026-6553-typo3-cms-stores-cleartext-password-in-user-settings-module)
- [svg-sanitizer Bypasses Attribute Sanitization](https://junglewise.ai/threats/cve-2025-55166-svg-sanitizer-bypasses-attribute-sanitization)