svg-sanitizer CVE-2026-117541

Exploitation requires a caller that passes attacker-controlled input to Sanitizer::sanitize() and (a) does NOT wrap the call in a broad catch(\Throwable), typically guarding only on a === false return - the common upload-rejection pattern the advisory describes. The specific trigger is a well-formed XML document that libxml accepts but that lacks exactly one top-level <svg> as a direct document child: a non-svg root element, a zero-<svg> document, or an <svg> nested inside another root (e.g. <html><body><svg/></body></html>); these pass loadXML() yet throw an uncaught LogicException from XPath::handleDefaultNamespace(). Affected versions are svg-sanitizer 0.11.0 up to (not including) 1.1.0. Limiting factors: a caller that already catches \Throwable is unaffected (crash avoided), and the impact is availability/robustness only - a thrown exception where false was expected can also cause the upload-rejection branch to be skipped. No authentication, user interaction, or non-default library configuration is required.

This is a medium-severity denial-of-service / robustness issue, not a high-impact priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) shows remote, low-complexity, unauthenticated reachability, but impact is confined to availability only (VC:N/VI:N/VA:L) - no confidentiality or integrity loss. SSVC reinforces moderate urgency: Exploitation=none (no observed exploitation), Automatable=yes (the trigger input is trivial to mass-produce), Technical Impact=partial. There is no CISA KEV listing and no EPSS score in the input, so there is no signal of active or widespread exploitation - consistent with SSVC Exploitation=none. The vuln.today decision label is this_month, which aligns with the medium CVSS and partial impact rather than an emergency. One nuance worth flagging: realized risk is conditional on integration style - the crash only occurs when the calling application does NOT wrap Sanitizer::sanitize() in a broad catch(\Throwable) and relies on the documented false return; the advisory notes this is common in upload paths, which is why AV:N/PR:N is defensible, but a defensively coded caller is unaffected. EPSS and KEV are both absent (not conflicting, simply not provided).

An attacker uploads a well-formed XML file whose root is not a single top-level <svg> (for example a non-svg root element, or an <svg> nested under <html>/<body>) to an endpoint that passes it through svg-sanitizer. loadXML() succeeds, XPath::handleDefaultNamespace() throws an uncaught LogicException, and sanitize() crashes the request/worker (PHP fatal error / HTTP 500) instead of returning false. The GHSA advisory publishes working proof-of-concept reproduction snippets; it is not labeled as a verified weaponized exploit in the input.