enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

Medium · CVSS 6.5

## Summary A crafted SVG file (1009 bytes) crashes the PHP process when sanitized by `enshrined/svg-sanitize` (any version through 0.22.x). The sanitizer's `cleanAttributesOnWhitelist()` method calls `DOMElement::removeAttribute()` twice on the same attribute name — first removing the explicit attribute, then attempting to remove the DTD `#FIXED` default — triggering a PHP ext/dom type confusion that kills the PHP-FPM worker.

Remediation

Upgrade enshrined/svg-sanitize to 1.0.0 or later.

Affected PHP branches

{'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'}

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-v383-3rw5-q8rf

← All threats