CVE-2026-117540: svg-sanitizer quadratic DoS in PHP tag stripping

CVE-2026-117540 · Severity: high · CVSS 7.5 · Published 2026-10-27

svg-sanitizer is a library that removes malicious code from SVG files. Under its default configuration, it fails to efficiently strip PHP tags from untrusted uploads, allowing attackers to upload specially crafted SVGs with overlapping PHP tag markers that force the sanitizer to repeatedly rescan the entire input string. An attacker can exhaust server CPU resources for tens of seconds with a few-hundred-kilobyte file, causing denial of service without any authentication or user interaction.

Technologies: Enshrined Svg-Sanitizer. Vendors: Enshrined.

Quick answers

Is CVE-2026-117540 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-117540 being exploited in the wild.
How severe is CVE-2026-117540?
High severity, with a CVSS score of 7.5, published 27 October 2026.
Which products and versions are affected?
Enshrined Svg-Sanitizer 0.5.3 through 1.0.0.
Is there a fix for CVE-2026-117540?
Yes: fixed in 1.1.0. Until then: Enforce a maximum input file size before the PHP tag stripping stage and reject oversized uploads. Alternatively, disable PHP tag stripping if it is not required for your use case (though this should not be the default for untrusted SVG processing). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-117540 attacked?
It is attacked over the network.
Am I affected by CVE-2026-117540?
Check whether you run Enshrined Svg-Sanitizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 1.1.0

Enforce a maximum input file size before the PHP tag stripping stage and reject oversized uploads. Alternatively, disable PHP tag stripping if it is not required for your use case (though this should not be the default for untrusted SVG processing).

Technical details

The vulnerability is a quadratic algorithmic complexity flaw in the pre-parse PHP tag stripping loop (src/Sanitizer.php:223–229). A do-while loop repeatedly applies preg_replace() over the entire input string to remove overlapping <?php…?> tags, with each iteration removing only one match and requiring a full re-scan. An attacker can craft input with O(n) overlapping tag openers and closers, forcing O(n²) total regex operations. This runs before XML parsing on every sanitize() call with no authentication required, and affects versions 0.5.3 through 1.0.0.

Affected products

  • enshrined svg-sanitizer 0.5.3 through 1.0.0

Timeline

  • 2026-10-19: disclosed: Advisory published on GitHub Security Advisory GHSA-2v7c-jx29-jprp
  • 2026-10-27: advisory: Published in NVD as CVE-2026-117540

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.