CVE-2025-55166: savg-sanitizer PHP Library XSS Vulnerability

CVE-2025-55166 Overview

CVE-2025-55166 affects savg-sanitizer, a PHP library used to sanitize SVG and XML content before rendering. The cleanXlinkHrefs method performs a case-sensitive attribute lookup that only matches lower-case attribute names. Attackers can bypass the isHrefSafeValue check by supplying mixed-case attributes such as xlink:Href or HREF. The bypass permits stored cross-site scripting (XSS) [CWE-79] and unauthorized linking to external domains through crafted SVG files. Version 0.22.0 fixes the issue by switching the substring search to a case-insensitive comparison.

Critical Impact
Attackers can smuggle malicious href attributes past sanitization to execute script in the victim's browser context or exfiltrate users to attacker-controlled domains.

Affected Products

darylldoyle/svg-sanitizer (savg-sanitizer) versions prior to 0.22.0
PHP applications that accept user-uploaded SVG content and rely on this library for sanitization
Content management systems and web platforms bundling the vulnerable release

Discovery Timeline

2025-08-12 - CVE-2025-55166 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55166

Vulnerability Analysis

The savg-sanitizer library walks each attribute on every SVG element and applies additional validation to any attribute whose name contains href. This handling exists because xlink:href and related attributes can trigger navigation or script execution even when the xlink namespace is not imported. The pre-patch code used PHP's strpos function, which performs a case-sensitive substring search.

Browsers, however, treat SVG attribute names as case-insensitive when parsing markup. An attribute named xlink:Href or HREF is honored during rendering, but the sanitizer's strpos($attrName, 'href') check returns false and skips validation. The isHrefSafeValue allow-list, which normally strips javascript: URIs and off-domain links, is never invoked for the mixed-case variant.

The result is a sanitization bypass that reintroduces cross-site scripting and open-redirect primitives that the library is specifically designed to block.

Root Cause

The root cause is a mismatch between the sanitizer's case-sensitive attribute matching and the browser's case-insensitive attribute parsing. Using strpos instead of stripos allows any capitalization variant of href to skip validation entirely.

Attack Vector

An attacker uploads or submits an SVG document containing an anchor element with a mixed-case href attribute pointing to a javascript: URI or attacker-controlled origin. When the sanitized SVG is later rendered in a victim's browser, the malicious link executes in the application's origin. Exploitation requires user interaction such as clicking the rendered element.

php

              * Such as xlink:href when the xlink namespace isn't imported.
              * We have to do this as the link is still ran in this case.
              */
-            if (false !== strpos($attrName, 'href')) {
+            if (false !== stripos($attrName, 'href')) {
                 $href = $element->getAttribute($attrName);
                 if (false === $this->isHrefSafeValue($href)) {
                     $element->removeAttribute($attrName);

Source: GitHub commit 5a0a1ea. The patch replaces strpos with stripos in src/Sanitizer.php so the href substring match is case-insensitive.

Detection Methods for CVE-2025-55166

Indicators of Compromise

SVG uploads containing attributes such as xlink:Href, XLINK:HREF, or HREF with mixed capitalization
SVG payloads containing javascript: URIs paired with non-lowercase href attribute names
Anchor or use elements in stored SVG assets that reference external, unexpected domains

Detection Strategies

Scan stored SVG content for href-style attributes whose names contain any upper-case characters
Grep application dependencies for darylldoyle/svg-sanitizer versions below 0.22.0 in composer.lock
Add web application firewall rules that flag uploaded SVG files containing javascript: schemes regardless of attribute casing

Monitoring Recommendations

Log all SVG uploads with filename, submitting user, and content hash for retrospective review
Monitor Content Security Policy (CSP) violation reports for inline script or off-origin navigation triggered by SVG rendering
Alert on outbound clicks from rendered user content to newly observed external domains

How to Mitigate CVE-2025-55166

Immediate Actions Required

Upgrade darylldoyle/svg-sanitizer to version 0.22.0 or later across all PHP projects
Audit historical SVG uploads for mixed-case href attributes and remove or re-sanitize affected files
Enforce a strict Content Security Policy that blocks inline scripts and restricts navigation targets

Patch Information

The fix is delivered in darylldoyle/svg-sanitizer 0.22.0. See the GitHub Security Advisory GHSA-22wq-q86m-83fh and the upstream commit that switches the attribute lookup to stripos.

Workarounds

Reject SVG uploads containing any attribute whose lower-cased name equals href or ends with :href when the value is not an allow-listed URL
Serve user-supplied SVGs from an isolated, sandboxed origin to contain XSS impact
Convert uploaded SVGs to rasterized formats such as PNG when vector fidelity is not required

bash

# Update the vulnerable library via Composer
composer require enshrined/svg-sanitize:^0.22.0
composer update enshrined/svg-sanitize

# Verify the installed version
composer show enshrined/svg-sanitize | grep versions