Medium

php-svg-lib lacks path validation on font through SVG inline styles

Disclosed: 21.02.2024
Updated: 11.10.2026 10:22

Summary

php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate if external references are allowed. This might leads to bypass of restrictions or RCE on projects that are using it, if they do not strictly revalidate the fontName that is passed by php-svg-lib.

Details

The Style::fromAttributes(), or the Style::parseCssStyle() should check the content of the font-family and prevents it to use a PHAR url, to avoid passing an invalid and dangerous fontName value to other libraries. The same check as done in the Style::fromStyleSheets might be reused :

                if (
                    \array_key_exists("font-family", $styles)
                    && (
                        \strtolower(\substr($this->href, 0, 7)) === "phar://"
                        || ($this->document->allowExternalReferences === false && \strtolower(\substr($this->href, 0, 5)) !== "data:")
                    )
                ) {
                    unset($style["font-family"]);
                }

PoC

Parsing the following SVG :

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="200" height="200">
    <text x="20" y="35" style="color:red;font-family:phar:///path/to/whatever.phar/blaklis;">My</text>
</svg>

will pass the phar:///path/to/whatever.phar/blaklis as $family in SurfaceCpdf::setFont, which is then passed to the canvas selectFont as a $fontName.

Impact

Libraries using this library as a dependency might be vulnerable to some bypass of restrictions, or even RCE, if they do not double check the value of the fontName that is passed by php-svg-lib

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Composer package	phenx/php-svg-lib	< 0.5.2	0.5.2

References

CVSS score 6.8/10

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Weakness (CWE): CWE-502, CWE-610, CWE-73
Platform: Composer
Package: phenx/php-svg-lib
Disclosed: 21.02.2024
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-f3qr-qr4x-j273 - CC BY 4.0

Vulnerability history: phenx/php-svg-lib

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 3
First → latest: 12.2023 02.2024
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
Medium 2

Disclosures per year

2023: 1
2024: 2
2025: 0
2026: 0

22.02.2024

Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE

Critical · 10.0 ghsa-97m3-52wr-xvv2 < 0.5.2 0.5.2
21.02.2024

php-svg-lib lacks path validation on font through SVG inline styles this entry

Medium · 6.8 CVE-2024-25117 < 0.5.2 0.5.2
13.12.2023

Denial of service caused by infinite recursion when parsing SVG document

Medium · 5.3 CVE-2023-50251 < 0.5.1 0.5.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application