EUVD-2025-24263

🗓️ 03 Oct 2025 20:07:09Reported by EUVDType

PHP savg-sanitizer had XSS via case-insensitive xlink href check; fixed in 0.22.0 and external links

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2025-55166	12 Aug 202510:23	–	circl
CNNVD	svg-sanitizer 输入验证错误漏洞	12 Aug 202500:00	–	cnnvd
CVE	CVE-2025-55166	12 Aug 202516:25	–	cve
Cvelist	CVE-2025-55166 svg-sanitizer By-Passing Attribute Sanitization	12 Aug 202516:25	–	cvelist
Github Security Blog	svg-sanitizer Bypasses Attribute Sanitization	12 Aug 202520:20	–	github
NVD	CVE-2025-55166	12 Aug 202517:15	–	nvd
OSV	CVE-2025-55166 svg-sanitizer By-Passing Attribute Sanitization	12 Aug 202516:25	–	osv
OSV	GHSA-22WQ-Q86M-83FH svg-sanitizer Bypasses Attribute Sanitization	12 Aug 202520:20	–	osv
Positive Technologies	PT-2025-32689 · Unknown · Svg-Sanitizer	12 Aug 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-55166	14 Aug 202516:54	–	redhatcve

[
  {
    "enisaIdVendor": [
      {
        "id": "d7a869ff-f7d0-3c52-8d4a-219bcca11381",
        "vendor": {
          "name": "darylldoyle"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "2cdf0797-2f45-340f-9797-b74bd43dd1ec",
        "product": {
          "name": "svg-sanitizer"
        },
        "product_version": "< 0.22.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-22wq-q86m-83fh
github	www.github.com/darylldoyle/svg-sanitizer/commit/5a0a1eaf0c6b0b540dc945fe30c93cf106b357c1
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-55166
github	www.github.com/darylldoyle/svg-sanitizer/commit/0afa95ea74be155a7bcd6c6fb60c276c39984500
github	www.github.com/darylldoyle/svg-sanitizer/blob/0.21.0/src/Sanitizer.php
github	www.github.com/darylldoyle/svg-sanitizer/releases/tag/0.22.0

03 Oct 2025 20:07Current

6.3Medium risk

Vulners AI Score6.3

CVSS 45.1

EPSS0.00079

SSVC