CVE-2023-50252: php-svg-lib unsafe attributes merge when parsing `use` tag
php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling <use> tag that references an <image> tag, it merges the attributes from the <use> tag to the <image> tag. The problem pops up especially when the href attribute from the <use> tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50252?
CVE-2023-50252 has been classified with a moderate severity due to its potential impact on the rendering of SVG files.
How do I fix CVE-2023-50252?
To fix CVE-2023-50252, upgrade php-svg-lib to version 0.5.1 or later, where the issue has been resolved.
What is the impact of CVE-2023-50252 on applications?
CVE-2023-50252 may lead to unexpected behavior when parsing SVG files, particularly affecting how attributes are merged.
Which versions of php-svg-lib are affected by CVE-2023-50252?
All versions of php-svg-lib prior to 0.5.1 are affected by CVE-2023-50252.
Is CVE-2023-50252 related to web application security?
Yes, CVE-2023-50252 is important for web application security as it affects the rendering of SVG graphics within applications.