CVE-2023-50252

Date: December 12, 2023

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling "<use>" tag that references an "<image>" tag, it merges the attributes from the "<use>" tag to the "<image>" tag. The problem pops up especially when the "href" attribute from the "<use>" tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue.

Language: PHP