svg-sanitizer EUVD-2026-115865

Requires: (1) the target running svg-sanitizer (enshrined/svg-sanitize) at version 1.1.0 with default settings; (2) the application passing attacker-controlled input to sanitize(); (3) PHP 8, where the bug surfaces as an uncaught ValueError. The trigger is specific: SVG input that ends inside a never-closed tag - smallest case a lone '<' (also '<a', '<svg', '<svg></svg><', or an SVG truncated mid-tag; the DOCTYPE path triggers with UTF-16/UTF-32 input cut inside a DOCTYPE) - which makes $offset point one past the end and breaks the strpos() scan at Sanitizer.php:770 (hasElementWithTooManyAttributes) or :731 (hasInternalDtdSubset). LIMITING FACTORS: on PHP 7 sanitize() returns false (no crash) unless the app converts warnings to exceptions; on PHP 8 the crash only propagates if the app does not catch Error/ValueError, as a catch(\Exception) wrapper will NOT stop it; impact is confined to failing the individual request with no persistent service outage.

This is a genuine but bounded availability issue, not a critical priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 and correctly captures that a remote, unauthenticated attacker can trigger the flaw over the network with low complexity and no user interaction, but every impact metric except VA is None (VA:L). The real-world effect is narrow: per the GHSA advisory, sanitize() throws an uncaught ValueError on PHP 8 so the single request processing the malformed SVG fails; there is no code execution, data exposure, or integrity loss, and nothing persists across requests. No EPSS score was provided and the CVE is not on CISA KEV, so there is no signal of widespread active exploitation - exploitation status is best described as no confirmed active exploitation, with a proof-of-concept published in the vendor advisory. The vuln.today decision label is this_month, consistent with a low-impact DoS rather than an emergency. Key caveat: impact depends on the host application - an app that wraps sanitize() in catch (\Exception) does NOT catch ValueError (it extends Error, not Exception), so the request fails; on PHP 7 the call returns false unless an error handler promotes the warning to an exception. Whether this is exploitable at all is therefore conditional on PHP version and application error handling, not on svg-sanitizer alone.

An attacker finds any endpoint of a PHP 8 application that passes untrusted, user-supplied SVG to svg-sanitizer 1.1.0's sanitize() with default settings. They submit a truncated payload ending inside an unclosed tag (as small as a single '<', or a DOCTYPE cut inside a UTF-16 stream), raising an uncaught ValueError from strpos() in findProblemBeforeParsing() and crashing the request. A working proof-of-concept is published in the GHSA advisory.