GitHub Advisoryadvisory · Packagist

GHSA-f6rx-hf55-4255 Sulu vulnerable to XXE in SVG File upload Inspector

MEDIUM Published 2025-05-15 Modified 2025-05-15 Official page ↗
Aliases
CVE-2025-47778
Ecosystem
Packagist
Packages
sulu/sulu
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-611
Reviewed
2025-05-15

Affected packages

• Packagist sulu/sulu: >= 2.5.21, < 2.5.25 → fixed in 2.5.25 • Packagist sulu/sulu: >= 2.6.5, < 2.6.9 → fixed in 2.6.9 • Packagist sulu/sulu: >= 3.0.0-alpha1, < 3.0.0-alpha3 → fixed in 3.0.0-alpha3

Description

Impact A admin user can upload SVG which may load external data via XML DOM library, specially this can be used for eventually reference none secure XML External Entity References. Patches The problem has not been patched yet. Users should upgrade to patched versions once they become available. Currently affected versions are: • 2.6.9 • 2.5.25 • 3.0.0-alpha3 Workarounds Patch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` in sulu with: ```diff -$dom->loadXML($svg, \LIBXML_NOENT | \LIBXML_DTDLOAD); +$dom->loadXML($data, LIBXML_NONET); ``` References • GitHub repository: https://github.com/sulu/sulu • Vulnerable code: https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php

Related

Alias · CVE (1)

  • CVE-2025-47778 Sulu is an open-source PHP content management system based on the Symfony framework. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References