CVE-2023-50252

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when the `href` attribute from the `<use>` tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue.

• CWE-15
• CWE-502

• https://github.com/dompdf/php-svg-lib/commit/08ce6a96d63ad7216315fae34a61c886dd2dc030Patch
• https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-jq98-9543-m4crExploit, Mitigation, Vendor Advisory
• https://github.com/dompdf/php-svg-lib/commit/08ce6a96d63ad7216315fae34a61c886dd2dc030Patch
• https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-jq98-9543-m4crExploit, Mitigation, Vendor Advisory

Published

Dec 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-50247h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …7.5
• CVE-2023-50248CKAN is an open-source data management system for powering d…6.5
• CVE-2023-50249Sentry-Javascript is official Sentry SDKs for JavaScript. A …7.5
• CVE-2023-5025A vulnerability was found in KOHA up to 23.05.03. It has bee…5.4
• CVE-2023-50250Cacti is an open source operational monitoring and fault man…6.1
• CVE-2023-50251php-svg-lib is an SVG file parsing / rendering library. Prio…7.5
• CVE-2023-50253Laf is a cloud development platform. In the Laf version desi…6.5
• CVE-2023-50254Deepin Linux's default document reader `deepin-reader` softw…7.8
• CVE-2023-50255Deepin-Compressor is the default archive manager of Deepin L…7.8
• CVE-2023-50256Froxlor is open source server administration software. Prior…7.5
• CVE-2023-50257eProsima Fast DDS (formerly Fast RTPS) is a C++ implementati…8.1
• CVE-2023-50258Medusa is an automatic video library manager for TV shows. V…5.3