CVE-2025-47778

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for insecure XML External Entity References. The problem has been patched in versions 2.6.9, 2.5.25, and 3.0.0-alpha3. As a workaround, one may patch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` manually.

Metrics

CVSS 4.0 6.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
sulu	sulu	>= 2.5.21, < 2.5.25; >= 2.6.5, < 2.6.9; >= 3.0.0-alpha1, < 3.0.0-alpha3

References

Timeline

Published: May 14, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-477796.5Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18 CVE-2025-47788.8A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been declared as critical. This vulnerability affects u CVE-2025-477807.8Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18 CVE-2025-477819.8Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based auth CVE-2025-477828.9motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0 CVE-2025-477836.1Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a m CVE-2025-477849.8Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefu CVE-2025-477858.8Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parame CVE-2025-477864.8Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered u CVE-2025-477879.8Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php compo CVE-2025-477889.4Atheos is a self-hosted browser-based cloud IDE. Prior to v602, similar to GHSA-rgjm-6p59-537v/CVE-2025-22152, the `$target` parameter in `/CVE-2025-477896.1Horilla is a free and open source Human Resource Management System (HRMS). In versions up to and including 1.3, an attacker can craft a Hori