svg-cheatsheet

SVG SSRF チートシート SVG を処理するホストは、SVG の豊富な機能セットにより、SSRF、LFI、XSS、RCE に対して脆弱になる可能性があります。 これらの方法はすべて URI を指定します。URI は絶対パスまたは相対パスにすることができます。file プロトコルと HTTP プロトコルはテストが重要ですが、実装によっては他のプロトコル（例: PHP ストリームスキーム）もサポートされる可能性があり、javascript: や data: も含まれます。 このドキュメントには、SVG でこの機能を悪用するために私が知っているすべての方法のリストが記載されています。 S...

CVE-2026-73057

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory...

CVE-2026-65687

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...

CVE-2026-65687

Bold Reports Standalone Report Designer (vulnerable before 14.1.12) contains a path traversal vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem, potentially exposing credentials and enabling full unauthorized acces...

EUVD-2026-48278

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...

CVE-2026-65687 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG Processing

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...

CVE-2026-65687 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG Processing

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...

CVE-2026-65687: Improper Limitation of a Pathname to a Restricted Directory

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...

@343dev/optimizt (>=12.0.0, <=13.0.0), @brickflow/cli (>=0.0.8, <=0.0.27) +63 more potentially affected by CVE-2026-73650 via svgo (>=4.0.0, <=4.0.1)

svgo NPM version =4.0.0, =12.0.0, =0.0.8, =0.0.1772240426360, =0.1.0, =1.0.0, =6.13.0, =0.0.1769658265953, =0.1.0-dev.00e4942, =1.1.0, =1.1.0, =1.1.0, =0.1.0, =1.0.44, =1.0.62 and more Source cves: CVE-2026-73650 Source advisory: OSV:GHSA-2P49-HGCM-8545...

SUSE-SU-2026:2877-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2026-53466: integer overflow in the XCF decoder can result in an out-of-bounds read when a crafted image is read bsc1270073. - CVE-2026-53467: allocated memory left unchanged in the MNG decoder can lead to a heap information disclosure...

USN-8337-1 qtsvg-opensource-src vulnerabilities

It was discovered that QtSvg incorrectly handled certain SVG images. An attacker could possibly use this issue to cause QtSvg to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. CVE-2018-19869 It was discovered that QtSvg incorrectly handled certain SVG images. ...

PT-2026-37624

Name of the Vulnerable Software and Affected Versions Qt SVG versions 6.7.0 through 6.8.7 Qt SVG versions 6.9.0 through 6.11.0 Description A type confusion issue in Qt SVG allows an attacker to cause an application crash through a crafted SVG image. When processing SVG marker references, the...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the use function in the SVG recursive processing workflow. An attacker can cause excessive CPU consumption by submitting a specially crafted SVG file with deeply nested...

GHSA-F38F-5XPM-9R7C CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification

Summary Kozea/CairoSVG 300K downloads/week has exponential denial of service via recursive element amplification in cairosvg/defs.py line 335. This causes CPU exhaustion from a small input. Severity High — CVSS 3.1: 7.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Vulnerable Code File:...

5ug-cli (>=1.0.72, <=1.4.0), @343dev/optimizt (6.0.0) +85 more potentially affected by CVE-2026-29074 via svgo (>=2.1.0, <=2.8.0)

svgo NPM version =2.1.0, =1.0.72, =1.1.2, =2.0.0-fix-trigger-remove-colors-config-e26731597751d1581014163b7e73df159cf80be3.1, =0.0.2-0, =4.55.0, =2.12.3-canary.621.15219.0, =2.1.0-beta-1, =2.1.0-beta-1, =2.1.8, =5.0.0, =0.0.1, =2.7.4, =3.59.1--canary.1316.b3452bb.0, =4.0.0--canary.2146.fe4f461.0...

@343dev/optimizt (>=12.0.0, <=12.1.1), @cjy0812/inspect-plus (>=0.0.1772240426360, <=0.0.1774152861718) +37 more potentially affected by CVE-2026-29074 via svgo (4.0.0-rc.0)

svgo NPM version 4.0.0-rc.0 is affected by a known vulnerability. The following packages have a transitive dependency on svgo and may be impacted: - @343dev/optimizt =12.0.0, =0.0.1772240426360, =6.13.0, =0.0.1769658265953, =1.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.47.0, =0.1.202510281000, =0.1....

Improper Encoding or Escaping of Output

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

CVE-2025-67419

A Denial of Service DoS vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the...

evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API

A Denial of Service DoS vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the...

Excessive Platform Resource Consumption within a Loop

Overview @evershop/evershop is a The React Ecommerce platform. Built with React and Postgres. Open-source and free. Fast and customizable. Affected versions of this package are vulnerable to Excessive Platform Resource Consumption within a Loop via the GET /images API endpoint when processing SVG...