Sulu vulnerable to XXE in SVG File upload Inspector

概要

-$dom->loadXML($svg, \LIBXML_NOENT | \LIBXML_DTDLOAD);
+$dom->loadXML($data, LIBXML_NONET);

参考情報

• sulu/sulu security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2025-47778 · ADVISORY
• sulu/sulu commit 02f52fc · WEB
• sulu/sulu · PACKAGE
• sulu/sulu · WEB

sulu/sulu のその他の脆弱性

• CVE-2026-92692中 6.9Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.…
• CVE-2026-82396中 5.4Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/Med…
• CVE-2026-82395中 5.3Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endp…
• CVE-2026-82394中 5.3Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link en…
• CVE-2026-45701中 6.9Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.23 and 3.0.6, the password reset …