CVE-2026-40301

MediumCVSS 4.7

Published: 17/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

25th percentile - higher than 25% of all known CVEs

Summary

DOMSanitizer (PHP 7.3+) before 1.0.10 allows <style> elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered.

Risk Assessment

This can lead to information leakage (e.g., IP addresses, headers) and enable SSRF or user tracking. Organizations rendering untrusted SVG are exposed to uncontrolled outbound requests.

Recommendation

Update DOMSanitizer to version 1.0.10 or later. Until then, consider blocking external references in SVG or filtering <style> elements.

Other vulnerabilities in DOMSanitizer

CVE-2026-100370Medium
DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the literal substring onload appears in the URL value (/^data:.*onload/i). Because data: payloads are routinely Base64-encoded, the dangerous content is invisible to that substring test. A URL such as data:text/html;base64,… therefore survives in href / xlink:href, even though the decoded payload is active markup. This is an incomplete input-validation / sanitization defect. Patched in version 1.0.15.

Original NVD description (English source)

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows <style> elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered. Version 1.0.10 fixes the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS