CVE-2026-117540

HIGH 7.5CVE-2026-117540 · Published 27/10/2026 · updated 02/11/2026

In short

CVE-2026-117540 is a HIGH (CVSS 7.5) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.35%, higher than 29.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes.

References

darylldoyle/svg-sanitizer commit 9ba9001
darylldoyle/svg-sanitizer security advisory
vulncheck.com/advisories/svg-sanitizer-before-1.1.0-quadratic-cpu-exhaustion-dos-via-php-tag-stripping-loop

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free