Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:LSummary
CVE-2023-50252 is a high-severity External Control of System or Configuration Setting (CWE-15) vulnerability in Dompdf Php-Svg-Lib. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by PATH Environment Variable (T1574.007); ranked in the top 2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
php-svg-lib is an SVG file parsing and rendering library that prior to version 0.5.1 contained a flaw in its handling of <use> tags referencing <image> tags. The library merges attributes from the <use> element onto the referenced <image> element without sanitizing the href attribute, which can result in an unsafe file read that triggers PHAR deserialization when the library is used with PHP versions earlier than 8. The issue is tracked under CWE-15 and CWE-502 and carries a CVSS 3.1 score of 8.3.
An unauthenticated remote attacker can supply a crafted SVG document containing a malicious <use> reference. When the document is processed by a vulnerable application, the attacker can cause arbitrary file reads on the server and potentially execute code through PHP object deserialization, all without user interaction.
The project addressed the flaw in release 0.5.1; the corresponding patch is available in commit 08ce6a96d63ad7216315fae34a61c886dd2dc030 and is described in GitHub Security Advisory GHSA-jq98-9543-m4cr. The EPSS score has remained essentially flat near 0.1 with no material post-disclosure increase.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-55067
Vulnerability Data
php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when…
more
the `href` attribute from the `<use>` tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 2 OS baselines
—
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
The policy and procedures establish internal controls and change management for system configuration settings, reducing the feasibility of external unauthorized modifications.
Baseline configuration under change control directly prevents unauthorized external modification of system or configuration settings.
Requires approval, documentation, and security impact review of all configuration changes, directly preventing unauthorized external control of system settings.
Impact analysis of configuration changes reduces the risk of deploying settings that permit unauthorized external control.
Restricting changes to system and configuration settings prevents external entities from controlling those settings without approval.
Establishing, implementing, approving deviations from, and monitoring configuration settings directly prevents external or unauthorized control of system settings.
The plan defines processes for identifying and managing configuration items, preventing external unauthorized control of system settings.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened configuration baselines and change controls directly limit external manipulation of settings.
Formal change and exception management catches externally driven configuration alterations.
Least-privilege access policies reduce unauthorized external modification of configuration values.
PR.PS-02 addresses only post-deployment updates/patching and cannot prevent introduction of unsafe deserialization code, yet it can remediate some instances when the flaw exists in outdated libraries or components.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Configuration management directly prevents external tampering with system settings.
Access rights assignment determines who may change system settings.
Privileged access rights reduce the number of users who can alter configuration.
Security testing includes validation of deserialization routines and the use of untrusted data, reducing the likelihood that unsafe object reconstruction will be deployed.
Information access restriction limits who can view or modify configuration data.
Change management enforces controlled, authorized modifications to settings.