CVE-2025-47778 - CVE House
Back to Database
Status published Medium CVE-2025-47778

Sulu vulnerable to XXE in SVG File upload Inspector

Vulnerability Description

Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for insecure XML External Entity References. The problem has been patched in versions 2.6.9, 2.5.25, and 3.0.0-alpha3. As a workaround, one may patch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` manually.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-47778

Credits & Attribution

No credits recorded in the NVD database.

References

More from sulu

View All →
CVE-2024-47618
Sulu vulnerable to XSS via uploaded SVG
Medium 5.1
CVE-2024-47617
Reflected XSS Vulnerability in Sulu Media Bundle
Medium 6.1
CVE-2024-37156
TokenController formName not sanitized in hidden input
Medium 6.1
CVE-2024-27915
Sulu grants access to pages regardless of role permissions
Medium 6.8
CVE-2024-24807
Sulu is vulnerable to HTML Injection via Autocomplete Suggestion
Low 2.7

Affected Vendor

Affected Software

sulu
Vulnerable Versions:
>= 2.5.21, < 2.5.25, >= 2.6.5, < 2.6.9, >= 3.0.0-alpha1, < 3.0.0-alpha3

Timeline

Official Publish: May 14th, 2025
Last Modified: May 14th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-611

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1040 Network Sniffing
Collection
T1105 Ingress Tool Transfer
Command and Control
T1499 Endpoint Denial of Service
Impact