PT-2026-136200

CVE-2026-121443

Published

2026-11-03

Updated

2026-11-03

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions svg-sanitizer versions 1.1.0 through 1.1.0

Description A denial of service issue exists where remote attackers can crash requests by submitting SVG input that ends inside an unclosed tag. On PHP 8, uploading truncated input, such as a single '<', triggers an uncaught ValueError from the strpos() function within hasElementWithTooManyAttributes() or hasInternalDtdSubset(), causing the request to fail.

Recommendations Update svg-sanitizer to version 1.1.1.

Exploitability

Exploit

Fix

Researchers

Nlemoine

Vendors

Affected products

Weakness enumeration

CWE-248: Uncaught Exception

Related identifiers

CVE-2026-121443