CVE-2025-55166

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute name, which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripting or linking to external domains. This issue has been patched in version 0.22.0.

• CWE-79
• CWE-601

• https://github.com/darylldoyle/svg-sanitizer/commit/5a0a1eaf0c6b0b540dc945fe30c93cf106b357c1
• https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-22wq-q86m-83fh

Published

Aug 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55160ImageMagick is free and open-source software used for editin…5.3
• CVE-2025-55161Stirling-PDF is a locally hosted web application that perfor…9.8
• CVE-2025-55162Envoy is an open source L7 proxy and communication bus desig…8.8
• CVE-2025-55163Netty is an asynchronous, event-driven network application f…7.5
• CVE-2025-55164content-security-policy-parser parses content security polic…8.8
• CVE-2025-55165Autocaliweb is a web app that offers an interface for browsi…8.2
• CVE-2025-55167WeGIA is an open source web manager with a focus on the Port…9.8
• CVE-2025-55168WeGIA is an open source web manager with a focus on the Port…9.8
• CVE-2025-55169WeGIA is an open source web manager with a focus on the Port…6.5
• CVE-2025-5517Heap-based Buffer Overflow vulnerability in ABB Terra AC wal…6.8
• CVE-2025-55170WeGIA is an open source web manager with a focus on the Port…7.4
• CVE-2025-55171WeGIA is an open source web manager with a focus on the Port…7.5