~ / search / GHSA-f6rx-hf55-4255

GHSA-f6rx-hf55-4255

Sulu vulnerable to XXE in SVG File upload Inspector

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-47778

Packages

EcosystemPackageAffectedFixed in
Packagist sulu/sulu >= 2.5.21, < 2.5.25 2.5.25
Packagist sulu/sulu >= 2.6.5, < 2.6.9 2.6.9
Packagist sulu/sulu >= 3.0.0-alpha1, < 3.0.0-alpha3 3.0.0-alpha3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A admin user can upload SVG which may load external data via XML DOM library, specially this can be used for eventually reference none secure XML External Entity References. ### Patches The problem has not been patched yet. Users should upgrade to patched versions once they become available. Currently affected versions are: - 2.6.9 - 2.5.25 - 3.0.0-alpha3 ### Workarounds Patch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` in sulu with: ```diff -$dom->loadXML($svg, \LIBXML_NOENT | \LIBXML_DTDLOAD); +$dom->loadXML($data, LIBXML_NONET); ``` ### References - GitHub repository: https://github.com/sulu/sulu - Vulnerable code: https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php

References

External links from the advisory. They lead to third-party sites.