CVEvulnerability

CVE-2025-47778

6.1 MEDIUM Published 2025-05-14 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-05-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 4.0 ([email protected])
6.1 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-611

Description

Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for insecure XML External Entity References. The problem has been patched in versions 2.6.9, 2.5.25, and 3.0.0-alpha3. As a workaround, one may patch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` manually.

Related

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References