CVE-2025-47778: Sulu vulnerable to XXE in SVG File upload Inspector
Impact
A admin user can upload SVG which may load external data via XML DOM library, specially this can be used for eventually reference none secure XML External Entity References.
Patches
The problem has not been patched yet. Users should upgrade to patched versions once they become available. Currently affected versions are:
- 2.6.9 - 2.5.25 - 3.0.0-alpha3
Workarounds
Patch the effect file src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php in sulu with:
diff -$dom->loadXML($svg, \LIBXMLNOENT | \LIBXMLDTDLOAD); +$dom->loadXML($data, LIBXMLNONET);
References
- GitHub repository: https://github.com/sulu/sulu - Vulnerable code: https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php
Other sources
Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for insecure XML External Entity References. The problem has been patched in versions 2.6.9, 2.5.25, and 3.0.0-alpha3. As a workaround, one may patch the effect file src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php manually.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47778?
CVE-2025-47778 is classified as a high severity vulnerability due to the potential for an attacker to exploit XML External Entity References.
How do I fix CVE-2025-47778?
To fix CVE-2025-47778, update to Sulu versions 2.6.10, 2.5.26, or 3.0.0-alpha4 or later.
Which versions of Sulu are affected by CVE-2025-47778?
CVE-2025-47778 affects Sulu versions up to 2.6.9, 2.5.25, and 3.0.0-alpha3.
What impact does CVE-2025-47778 have on my Sulu installation?
CVE-2025-47778 allows an admin user to upload SVG files that can load external data, potentially exposing the system to malicious attacks.
Is there a workaround for CVE-2025-47778 if I cannot update immediately?
A temporary workaround for CVE-2025-47778 is to restrict admin user access to upload SVG files until a patch can be applied.