Riskcovery

CVE-2023-27586

CairoSVG improperly processes SVG files loaded from external resources

State
Published
Severity
9.9 Critical
Published
Mar 20, 2023
Updated
Feb 25, 2025
Reserved
Mar 4, 2023

Read the record on cve.org

Description

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.

Scores

CVSSScoreVectorSource
3.19.9 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:LGitHub_M

Weaknesses

  • CWE-20 Improper Input Validation
  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
CairoSVGKozea
  • < 2.7.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.