CVE-2026-107381: 
PHP vulnerability analysis and mitigation

CVE-2026-107381 is a Denial-of-Service (DoS) vulnerability in the enshrined/svg-sanitize PHP library (darylldoyle/svg-sanitizer) caused by improper handling of case sensitivity in SVG <use> element reference resolution. Affecting all versions up to and including 0.22.0, the flaw allows an attacker to bypass the library's nesting-DoS protection by submitting SVG files with mixed-case xlink:HrEf attributes, resulting in a "nesting bomb" being passed through sanitization intact. It was published on September 1, 2026, and added to the GitHub Advisory Database on October 8, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is a combination of CWE-178 (Improper Handling of Case Sensitivity) and CWE-400 (Uncontrolled Resource Consumption). In Resolver::processReferences() (src/ElementReference/Resolver.php:97-118), <use> elements are collected via the XPath predicate use[@href or @xlink:href], which is case-sensitive. A <use> element using xlink:HrEf (mixed case) is therefore never added to the reference graph, so the nesting-DoS nullification logic never marks it for removal. Subsequently, Sanitizer::cleanHrefAttributes() (src/Sanitizer.php:479-504) normalizes xlink:HrEf back to the canonical xlink:href, producing a fully live nesting bomb with canonical attribute names in the sanitizer's output. The ordering bug — building the resolver graph before normalizing attribute casing — is the core issue, and it is the mirror image of CVE-2025-55166, which made href value checking case-insensitive but left the reference graph node selection case-sensitive (GitHub Advisory, Security Advisory).

Successful exploitation causes a high-availability impact on any application that accepts, sanitizes, and serves SVG files using this library. An attacker with no privileges beyond the ability to upload or paste an SVG can deliver a deeply nested <use> reference structure (nesting bomb) that survives sanitization intact, potentially consuming excessive CPU or memory when the SVG is subsequently rendered or processed. There is no confidentiality or integrity impact; the vulnerability is purely a DoS vector (GitHub Advisory).

No in-the-wild exploitation has been reported, and no public exploit kit or weaponized code is known at this time. A proof-of-concept is described in the advisory: it requires only modifying the project's own tests/data/useDosTest.svg fixture by replacing xlink:href with xlink:HrEf, then submitting it to a vulnerable sanitizer instance. The CVE status is listed as "Reserved" and it is not currently in the CISA Known Exploited Vulnerabilities (KEV) catalog. No EPSS score is available at this time (GitHub Advisory, Security Advisory).

1. Identify a target: Find an application that accepts SVG file uploads or inline SVG input and uses enshrined/svg-sanitize version ≤ 0.22.0 for sanitization before serving or rendering the SVG.
2. Craft the payload: Take a deeply nested SVG <use> nesting bomb (e.g., based on the library's own tests/data/useDosTest.svg fixture) and replace all canonical xlink:href attribute names with a mixed-case variant such as xlink:HrEf.
3. Submit the SVG: Upload or paste the crafted SVG through the application's normal SVG intake mechanism (e.g., file upload form, API endpoint). No authentication or elevated privileges are required.
4. Bypass sanitization: The sanitizer's Resolver::processReferences() fails to detect the <use> elements due to case-sensitive XPath matching, so the nesting-DoS nullification is skipped. cleanHrefAttributes() then normalizes xlink:HrEf back to xlink:href, producing a fully live nesting bomb in the sanitizer output.
5. Trigger DoS: When the application or a downstream user renders the sanitized SVG, the deeply nested <use> references are expanded, consuming excessive CPU/memory and causing a denial-of-service condition (GitHub Advisory, Security Advisory).

• Network: Incoming HTTP requests containing SVG payloads with mixed-case xlink:HrEf or HrEf attribute names in <use> elements, particularly with deeply nested structures.
• File System: Uploaded SVG files containing xlink:HrEf, xlink:HREF, HrEf, or HREF attribute variants in <use> elements; presence of deeply nested <use> reference chains in stored SVG files.
• Logs: Application or web server logs showing repeated SVG upload requests followed by high CPU/memory usage or timeouts during SVG rendering; PHP error logs indicating memory exhaustion or execution time limit exceeded during SVG processing.
• Process: Abnormal CPU or memory spikes in the PHP process handling SVG sanitization or rendering, particularly correlated with SVG file upload events (GitHub Advisory).

Upgrade the enshrined/svg-sanitize Composer package to version 1.0.0, which fixes the vulnerability by removing the case-sensitive XPath predicate from Resolver::processReferences() and making Helper::getElementHref() perform a case-insensitive lookup for href/xlink:href attributes (Release 1.0.0, Fix Commit). No configuration-based workaround is available; upgrading is the only reliable remediation. As a temporary measure, applications can reject SVG uploads containing mixed-case href attribute names (e.g., HrEf, HREF, xlink:HrEf) at the input validation layer before passing to the sanitizer.

The vulnerability was discovered and reported by security researcher arpitjain099, who identified it by reviewing the CVE-2025-55166 patch and noting that the resolver's XPath predicate had not been made case-insensitive. The reporter used AI assistance during the review process and confirmed the issue by running a manual proof-of-concept against tag 0.22.0. The fix was merged by the maintainer (darylldoyle) as part of the 1.0.0 release, which also included several other improvements (Security Advisory, Release 1.0.0).