CVE-2026-107379: 
PHP vulnerability analysis and mitigation

CVE-2026-107379 is a Denial of Service vulnerability in enshrined/svg-sanitize (also distributed as darylldoyle/svg-sanitizer), a PHP SVG/XML sanitization library. A crafted SVG file containing an internal DTD with a #FIXED attribute default causes the sanitizer's cleanAttributesOnWhitelist() method to call DOMElement::removeAttribute() twice on the same attribute name, corrupting libxml state and terminating the PHP-FPM worker process with SIGABRT. All versions through 0.22.0 are affected; the issue is fixed in version 1.0.0, published September 1, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) for the default WordPress/Author-role scenario, and up to 7.5 (High) for unauthenticated public endpoints (Github Advisory, Security Advisory).

The root cause (CWE-770: Allocation of Resources Without Limits or Throttling) lies in the sanitizer's failure to strip DOCTYPE/DTD declarations before passing SVG content to PHP's DOMDocument::loadXML(). When a malicious SVG includes an internal DTD ATTLIST declaration with a #FIXED default for an attribute whose name contains "href" (e.g., badhref), the following double-removal sequence occurs: (1) cleanAttributesOnWhitelist() removes the explicit attribute because it is not on the allowlist; (2) getAttribute("badhref") then returns the DTD-rematerialized #FIXED default value; (3) isHrefSafeValue() returns FALSE for the javascript: payload; (4) a second removeAttribute("badhref") call targets the underlying XML_ATTRIBUTE_DECL node, corrupting libxml memory. A secondary trigger path exists in cleanHrefAttributes() via case-normalization of mixed-case HrEf. The attack requires only network access and the ability to submit SVG content to a sanitization endpoint (Github Advisory, Security Advisory).

Successful exploitation kills the PHP-FPM worker process via SIGABRT (exit code 134), causing an HTTP 502 Bad Gateway response. Because workers respawn but each malicious request kills one, an automated loop of concurrent uploads can exhaust all pm.max_children workers and sustain a complete application outage. Beyond pure availability loss, the abrupt SIGABRT bypasses PHP's register_shutdown_function(), which on WordPress+WooCommerce installations can cause application state corruption: single-use coupons may be reused unlimited times, stock reduction may not be committed (enabling overselling), and wp_cron tasks may be starved indefinitely. There is no confidentiality or integrity impact in the direct exploitation path (Github Advisory, Security Advisory).

A proof-of-concept exploit — a 1009-byte malicious SVG file with a confirmed crash output (munmap_chunk(): invalid pointer, exit code 134) — is publicly documented in the GitHub Security Advisory (Security Advisory). The NVD SSVC assessment classifies exploitation status as "poc" and automatable as "no". The EPSS score is approximately 0.376%, indicating a low but non-negligible probability of exploitation in the near term. No in-the-wild exploitation or threat actor attribution has been reported as of the advisory date. The vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Craft the malicious SVG: Create a small SVG file ("evil.svg") containing an internal DTD that declares an ATTLIST for the root <svg> element with a #FIXED default value for an attribute whose name contains "href" (e.g., badhref), and also set that attribute explicitly on the root element with a javascript: payload:

<?xml version="1.0"?>
<!DOCTYPE svg [
  <!ATTLIST svg badhref CDATA #FIXED "javascript:alert(1)">
]>
<svg xmlns="http://www.w3.org/2000/svg" badhref="javascript:alert(1)">
</svg>

2. Identify the target endpoint: Locate an application that passes attacker-supplied SVG content to enshrined\svgSanitize\Sanitizer::sanitize(). Common targets include WordPress sites with the Safe SVG plugin (any version ≤ 2.4.0) accessible via the Media upload UI or REST API (POST /wp/v2/media), TYPO3 backend editors (v9+), or custom PHP applications with public SVG upload endpoints.
3. Submit the malicious SVG (WordPress path): Log in as a user with the upload_files capability (Author role or higher). Navigate to Media → Add New and upload evil.svg. The upload triggers wp_handle_upload_prefilter → safe_svg::sanitize() → enshrined\Sanitizer::sanitize().
4. Trigger the crash: The sanitizer calls DOMDocument::loadXML(), which parses the DTD and creates an XML_ATTRIBUTE_DECL node. cleanAttributesOnWhitelist() removes the explicit badhref attribute, then getAttribute("badhref") returns the DTD #FIXED default, isHrefSafeValue() returns FALSE, and a second removeAttribute("badhref") corrupts libxml state, killing the PHP-FPM worker (SIGABRT). The server returns HTTP 502 Bad Gateway.
5. Sustain the DoS: Automate repeated concurrent SVG uploads in a loop. Each request kills one PHP-FPM worker; with enough concurrent requests matching pm.max_children, all workers are exhausted and the application becomes completely unavailable until workers respawn (Security Advisory).

• Network: Repeated HTTP POST requests to /wp/v2/media, /wp-admin/async-upload.php, or custom SVG upload endpoints in rapid succession from the same or rotating source IPs; HTTP 502 Bad Gateway responses immediately following SVG upload requests.
• Logs (PHP-FPM): Log entries such as [WARNING] [pool www] child <PID> exited on signal 6 (SIGABRT) appearing repeatedly in the PHP-FPM error log; frequent worker respawn events.
• Logs (Web Server): nginx/Apache access logs showing SVG upload requests immediately followed by 502 status codes; error logs recording upstream connection failures to PHP-FPM.
• Process: PHP-FPM worker processes terminating with exit code 134 (munmap_chunk(): invalid pointer output); abnormally high PHP-FPM worker churn visible via process monitoring.
• File System: Presence of uploaded SVG files containing <!DOCTYPE and <!ATTLIST declarations with #FIXED keywords in the web application's upload or temp directory (Security Advisory).

Upgrade enshrined/svg-sanitize to version 1.0.0 via Composer (composer require enshrined/svg-sanitize:^1.0.0); this release strips DOCTYPE/DTD declarations before parsing, preventing the #FIXED attribute from ever materializing (1.0.0 Release, Patch Commit). WordPress users should also update the Safe SVG plugin to a version bundling svg-sanitize 1.0.0. As an immediate workaround if patching is not possible, restrict SVG upload/submission capabilities to highly trusted users only (e.g., remove the upload_files capability from Author-role users), implement rate limiting on sanitization endpoints, and consider adding a pre-processing step to strip DOCTYPE declarations: $dirty = preg_replace('/<!DOCTYPE[^>[]*(?:\[[^]]*\])?\s*>/si', '', $dirty); (Github Advisory).

The vulnerability was discovered and reported by Denis Rostilov of ExPatch Security Research (expatch.llc), who provided a detailed advisory including a concrete PoC payload, WordPress reproduction steps, and secondary impact analysis covering WooCommerce state corruption (Security Advisory). The advisory highlights the broad attack surface: the library has 45.2M Packagist downloads (1.3M/month), 90+ dependents, and is integrated into WordPress Safe SVG (1M+ active installs), TYPO3 core (since v9), and Drupal community modules. No significant independent researcher commentary or broad media coverage has been identified beyond the official advisory and standard vulnerability database aggregation.