CVE-2024-25117

Summary

CVE-2024-25117 is a vulnerability affecting the php-svg-lib library before version 0.5.2. This issue arises due to the library's failure to validate font-family, allowing potentially harmful PHAR urls. Consequences include bypassing restrictions or even remote code execution (RCE) on PHP versions below 8.0. Libraries that use php-svg-lib as a dependency and do not validate the fontName passed to them may also be vulnerable. The recommended solution is to upgrade to version 0.5.2, which includes a fix for this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.