{
  "cveId": "CVE-2023-50252",
  "url": "https://patchblox.com/security/cve/CVE-2023-50252",
  "summary": "CVE-2023-50252 is fixed in php-dompdf-svg-lib on 1 platform by DEBIAN-CVE-2023-50252 (version 0.5.0-3\u002Bdeb12u1), released December 12, 2023. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "php-dompdf-svg-lib: php-svg-lib is an SVG file parsing / rendering library",
  "description": "php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling \u0060\u003Cuse\u003E\u0060 tag that references an \u0060\u003Cimage\u003E\u0060 tag, it merges the attributes from the \u0060\u003Cuse\u003E\u0060 tag to the \u0060\u003Cimage\u003E\u0060 tag. The problem pops up especially when the \u0060href\u0060 attribute from the \u0060\u003Cuse\u003E\u0060 tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue.",
  "published": "2023-12-12T21:15:08Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.23903,
  "epssPercentile": 0.97845,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "php-dompdf-svg-lib",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "0.5.0-3\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2023-50252",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-50252",
      "released": "2023-12-12T21:15:08Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}