CVE-2026-107379 darylldoyle CVE debrief

Who should care

Defenders responsible for systems using `enshrined/svg-sanitize`, WordPress Safe SVG plugin, TYPO3, and Drupal should assess the impact of this vulnerability and prioritize verification and remediation efforts.

Why it matters

CVE-2026-107379 is a denial-of-service vulnerability in `enshrined/svg-sanitize` that can crash the PHP process when sanitizing crafted SVG files. Defenders should prioritize verification and remediation efforts, especially for systems using `enshrined/svg-sanitize`, WordPress Safe SVG plugin, TYPO3, and Drupal.

• Potential denial-of-service attacks against systems using `enshrined/svg-sanitize`, WordPress Safe SVG plugin, TYPO3, and Drupal.
• Verification of exposure and impact is required to prevent potential attacks.
• Remediation priority is high for systems using vulnerable versions of `enshrined/svg-sanitize`.
• Further investigation is needed to determine the full scope of affected systems and potential consequences.

Technical summary

The `enshrined/svg-sanitize` library is vulnerable to a denial-of-service attack when sanitizing crafted SVG files. The vulnerability is caused by a type confusion bug in the sanitizer's `cleanAttributesOnWhitelist()` method, which calls `DOMElement::removeAttribute()` twice on the same attribute name, triggering a PHP ext/dom type confusion that kills the PHP-FPM worker. This issue affects multiple projects, including WordPress Safe SVG plugin, TYPO3, and Drupal. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using `enshrined/svg-sanitize`, WordPress Safe SVG plugin, TYPO3, and Drupal. Immediate action is required to prevent potential denial-of-service attacks.

Recommended defensive actions

• Verify if your system uses `enshrined/svg-sanitize`, WordPress Safe SVG plugin, TYPO3, or Drupal and assess the impact of this vulnerability.
• Update `enshrined/svg-sanitize` to version 1.0.0 or later.
• Implement input validation and sanitization for SVG files.
• Monitor system logs for potential denial-of-service attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The source corpus provides detailed information about the vulnerability, including a crafted SVG file that crashes the PHP process when sanitized by `enshrined/svg-sanitize`. The sanitizer's `cleanAttributesOnWhitelist()` method calls `DOMElement::removeAttribute()` twice on the same attribute name, triggering a PHP ext/dom type confusion that kills the PHP-FPM worker.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.