CVE-2023-50252 Information

Description

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1 when handling <use> tag that references an <image> tag it merges the attributes from the <use> tag to the <image> tag. The problem pops up especially when the href attribute from the <use> tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue.

Reference

https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-jq98-9543-m4cr https://github.com/dompdf/php-svg-lib/commit/08ce6a96d63ad7216315fae34a61c886dd2dc030