CVE-2026-107380: 
PHP vulnerability analysis and mitigation

CVE-2026-107380 is a stored Cross-Site Scripting (XSS) vulnerability in the enshrined/svg-sanitize PHP library (also known as darylldoyle/svg-sanitizer) caused by a DTD entity / HTML5 Named Character Reference collision. Versions up to and including 0.22.0 are affected; the issue is fixed in version 1.0.0. The vulnerability was reported by ExPatch Security Research (Denis Rostilov), published to the GitHub Advisory Database on September 1, 2026, and assigned CVE-2026-107380 on October 8, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium), though the advisory notes that effective severity can reach High when chained with session-stealing or admin takeover (Github Advisory).

The root cause (CWE-79) is a semantic mismatch between two processing contexts in Sanitizer.php. The isHrefSafeValue() function evaluates SVG href attributes after XML DTD entity expansion: a crafted entity (e.g., 	) is defined in the DTD to expand to "#", so the sanitizer sees href="#javascript:alert(document.domain)" and passes it as a safe fragment reference. However, saveXML() serializes the original entity reference (not the expanded value) and strips the DOCTYPE declaration from the output. When the sanitized SVG is later embedded inline in HTML, the browser resolves 	 as the HTML5 Named Character Reference for U+0009 (Horizontal Tab), a character the URL parser strips as leading whitespace — leaving javascript:alert(document.domain) as the effective URL scheme. The bug is purely a logic flaw in the sanitizer and is independent of PHP version or ext/dom behavior; it was confirmed exploitable on Chrome 148 with PHP 8.3.24 (Github Advisory, Security Commit).

Successful exploitation results in stored XSS executing arbitrary JavaScript in the embedding page's origin when a victim user clicks the malicious link within the rendered SVG. An attacker can steal session tokens (document.cookie), perform authenticated actions on behalf of the victim (e.g., fetch('/wp-admin/...')), or achieve full account takeover. The vulnerability affects any application that embeds sanitized SVG inline in HTML — notably the WordPress Safe SVG plugin (1M+ active installs), TYPO3, Drupal, and 90+ other Packagist dependents of the library, which has 45.2M total Packagist downloads. Rendering SVGs via an <img> tag is NOT affected, as the browser uses the XML parser in that context (Github Advisory).

No public proof-of-concept exploit code has been released, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The advisory does include a detailed PoC walkthrough (including a XSS_CONFIRMED_POC.html file) sufficient for a skilled attacker to reproduce the issue. Exploitation requires low privileges (e.g., Author-level access in WordPress to upload an SVG) and user interaction (a victim must click the link). The EPSS score is approximately 0.208% (10th percentile), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution is available.

1. Identify a target: Find a web application using enshrined/svg-sanitize <= 0.22.0 that accepts SVG uploads and renders them inline in HTML (e.g., a WordPress site using the Safe SVG plugin with a theme that echoes file_get_contents($svg_path)).
2. Craft a malicious SVG: Create an SVG file with a DTD that defines a custom entity whose name collides with an HTML5 Named Character Reference. For example, define 	 to expand to "#" in XML context:

<?xml version="1.0"?>
<!DOCTYPE svg [
  <!ENTITY Tab "#">
]>
<svg xmlns="http://www.w3.org/2000/svg">
  <a href="&Tab;javascript:alert(document.domain)">
    <rect width="100" height="100" fill="red"/>
    <text>CLICK ME</text>
  </a>
</svg>

3. Upload the SVG: Submit the crafted SVG through the application's upload endpoint (e.g., WordPress media upload as an Author-level user). The sanitizer evaluates href as "#javascript:alert(document.domain)" (starts with #) and passes it as safe.
4. Observe sanitizer output: The sanitizer strips the DOCTYPE but preserves the entity reference 	 in the serialized output, producing: <a href="&Tab;javascript:alert(document.domain)">.
5. Trigger victim interaction: When the application renders the sanitized SVG inline in an HTML page, the browser resolves 	 as U+0009 (TAB), which the URL parser strips as leading whitespace. The effective href becomes javascript:alert(document.domain).
6. Achieve XSS: A victim user who clicks the red rectangle triggers JavaScript execution in the page's origin. Replace alert(document.domain) with a payload to exfiltrate document.cookie or perform admin actions (Github Advisory).

• File System: Uploaded SVG files containing <!DOCTYPE or <!ENTITY declarations in the application's media/upload directory; SVG files with href attributes containing javascript: (possibly obfuscated with entity references like 	 or 
).
• Logs: Web server access logs showing SVG file uploads from low-privileged accounts followed by requests to pages that render those SVGs inline; application error logs showing unexpected XML parse errors after the patch is applied (indicating attempted exploitation post-patch).
• Network: Outbound requests from victim browsers to attacker-controlled domains shortly after loading pages with inline SVG content (e.g., cookie exfiltration via fetch or XMLHttpRequest to an external endpoint).
• Application Behavior: SVG files that pass sanitization but contain entity references (	, 
) in href or xlink:href attributes in the sanitizer's output — these should not appear in patched versions (Github Advisory).

Update enshrined/svg-sanitize to version 1.0.0 immediately via Composer: composer require enshrined/svg-sanitize:^1.0.0. The fix strips the entire DOCTYPE/DTD block before parsing, preventing custom entity definitions from ever reaching libxml — documents referencing custom entities are now rejected outright (returning false) (Security Commit, Release 1.0.0). As a defense-in-depth measure, implement a Content Security Policy (CSP) with script-src restrictions to limit inline script execution, and avoid rendering sanitized SVGs inline in HTML where possible — serving them via <img> tags eliminates this attack vector entirely (Github Advisory).

The vulnerability was reported by ExPatch Security Research (Denis Rostilov / expatch.llc) and disclosed responsibly to the maintainer. The advisory highlights the broad supply-chain impact, noting 45.2M Packagist downloads, 1.3M downloads/month, and over 90 dependents including the WordPress Safe SVG plugin with 1M+ active installs, TYPO3, and Drupal. The GitHub advisory was reviewed and published on October 8, 2026, and the fix was incorporated into the library's first major semantic version release (1.0.0) (Github Advisory, Release 1.0.0).