Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-50252 is a high-severity External Control of System or Configuration Setting (CWE-15) vulnerability in Dompdf Php-Svg-Lib. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Winlogon Helper DLL (T1547.004); ranked in the top 2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
php-svg-lib is an SVG file parsing and rendering library that prior to version 0.5.1 contained a flaw in its handling of <use> tags referencing <image> tags. The library merges attributes from the <use> element onto the referenced <image> element without sanitizing the href attribute, which can result in an unsafe file read that triggers PHAR deserialization when the library is used with PHP versions earlier than 8. The issue is tracked under CWE-15 and CWE-502 and carries a CVSS 3.1 score of 8.3.
An unauthenticated remote attacker can supply a crafted SVG document containing a malicious <use> reference. When the document is processed by a vulnerable application, the attacker can cause arbitrary file reads on the server and potentially execute code through PHP object deserialization, all without user interaction.
The project addressed the flaw in release 0.5.1; the corresponding patch is available in commit 08ce6a96d63ad7216315fae34a61c886dd2dc030 and is described in GitHub Security Advisory GHSA-jq98-9543-m4cr. The EPSS score has remained essentially flat near 0.1 with no material post-disclosure increase.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-55067
Vulnerability Data
php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when…
more
the `href` attribute from the `<use>` tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 2 OS baselines
—
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
The policy and procedures establish internal controls and change management for system configuration settings, reducing the feasibility of external unauthorized modifications.
Baseline configuration under change control directly prevents unauthorized external modification of system or configuration settings.
Requires approval, documentation, and security impact review of all configuration changes, directly preventing unauthorized external control of system settings.
Impact analysis of configuration changes reduces the risk of deploying settings that permit unauthorized external control.
Restricting changes to system and configuration settings prevents external entities from controlling those settings without approval.
Establishing, implementing, approving deviations from, and monitoring configuration settings directly prevents external or unauthorized control of system settings.
The plan defines processes for identifying and managing configuration items, preventing external unauthorized control of system settings.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Formal change and exception management catches externally driven configuration alterations.
Least-privilege access policies reduce unauthorized external modification of configuration values.
Hardened configuration baselines and change controls directly limit external manipulation of settings.
PR.PS-02 addresses only post-deployment updates/patching and cannot prevent introduction of unsafe deserialization code, yet it can remediate some instances when the flaw exists in outdated libraries or components.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 only requires that access control policies and rules be defined and documented; it does not itself enforce, implement or configure those rules to stop external control of system/configuration settings, so the weakness remains fully exploitable.
A.5.18 governs the provisioning, review, and revocation of authorized access rights; it has no bearing on whether a system or configuration setting can be externally controlled by a user (CWE-15).
Documented operating procedures define how configuration changes must be performed.