CVE-2025-47778CWE-611

Sulu vulnerable to XXE in SVG File upload Inspector

Medium · published May 14, 2025

CVSS v4.0
6.1
EPSS
0%
Percentile
39.6
In the wild
Unconfirmed
What it is

Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for insecure XML External Entity References. The problem has been patched in versions 2.6.9, 2.5.25, and 3.0.0-alpha3. As a workaround, one may patch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` manually.

The record
Technical detail
CVSS v4.0
6.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
EPSS
0.00469 · 39.6th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2025-05-14T15:29Z
EPSS history
Timeline
  • 14 MAY 15:29Z
    Sulu vulnerable to XXE in SVG File upload Inspector
    cvelistv5