PT-2026-80143

TuxCare rebuilt phenx/php-svg-lib to address 3 CVEs. Fixed in 0.4.1-p1+tuxcare...

CLSA-2026-1773276768 TuxCare security update for phenx/php-svg-lib (3 CVEs)

TuxCare rebuilt phenx/php-svg-lib to address 3 CVEs. Fixed in 0.3.4-p1+tuxcare...

PT-2026-73958

TuxCare rebuilt phenx/php-svg-lib to address 3 CVEs. Fixed in 0.3.4-p1+tuxcare...

External Control Of Filename

phenx/php-svg-lib is vulnerable to External Control of Filename. The vulnerability is due to insecure handling of inline CSS font definitions, allowing an attacker to deserialize a PHAR file through the phar:// URL handler. Note that remote code execution is only possible on PHP versions less the...

Insecure Deserialization/Unsafe Attributes Merge

phenx/php-svg-lib is vulnerable to Insecure Deserialization. The vulnerability is caused due to unsafe attributes such as href, xlink:href and id while merging attributes from the tag to the tag when handling a tag that references an tag. This can lead to an unsafe file read that can cause PHAR...

Cross-Site Scripting (XSS)

PhenX/php-font-lib is vulnerable to cross-site scripting XSS attacks. The attacker can inject arbitrary script via the name parameter since it does not encode it properly using the htmlentities method...