CVE-2025-47778: Sulu/sulu Sulu Vulnerable To XXE Vulnerability

Q: What is CVE-2025-47778?

CVE-2025-47778 is a security vulnerability in Sulu/sulu involving Sulu vulnerable to XXE in SVG File upload Inspector under CWE-611: Improper Restriction of XML External Entity Reference.

Q: Which Sulu/sulu versions are affected?

Affected versions include releases prior to 2.5.25, 2.6.9, 3.0.0-alpha3 across affected packages: sulu/sulu.

Q: What version fixes CVE-2025-47778?

Upgrading to 2.5.25, 2.6.9, 3.0.0-alpha3 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is sulu/sulu affected?

Yes, sulu/sulu is affected in releases prior to 2.5.25, 2.6.9, 3.0.0-alpha3. Upgrade your dependency to 2.5.25, 2.6.9, 3.0.0-alpha3 or later.

Q: What CWE is associated with CVE-2025-47778?

CVE-2025-47778 is classified under CWE-611: Improper Restriction of XML External Entity Reference (The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.).

Q: How can I check Packagist dependencies for CVE-2025-47778?

Run the dependency tree command: 'inspect dependencies for sulu/sulu'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

MODERATE

Advisory Identifier: GHSA-f6rx-hf55-4255

CWE-611

Published 2025-05-15

Advisory Summary

CVE-2025-47778 is a MODERATE sulu vulnerable to xxe vulnerability (CWE-611: Improper Restriction of XML External Entity Reference) affecting Sulu/sulu libraries in the Packagist ecosystem. The issue involves sulu vulnerable to xxe in svg file upload inspector. Remediation is available by upgrading affected packages to version 2.5.25, 2.6.9, 3.0.0-alpha3.

CVE-2025-47778 at a Glance

CVE Identifier CVE-2025-47778

GHSA Identifier GHSA-f6rx-hf55-4255

Severity MODERATE

CVSS v3.1 Base Score N/A

CWE Classification CWE-611: Improper Restriction of XML External Entity Reference

Affected Product Sulu/sulu

Package Ecosystem Packagist

Published Date 2025-05-15

Last Updated 2025-05-15

How to Fix CVE-2025-47778

To remediate this vulnerability, upgrade all affected Sulu/sulu dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

sulu/sulu fixed: 2.5.25

Upgrade sulu/sulu to 2.5.25

sulu/sulu fixed: 2.6.9

Upgrade sulu/sulu to 2.6.9

sulu/sulu fixed: 3.0.0-alpha3

Upgrade sulu/sulu to 3.0.0-alpha3

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for sulu/sulu

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-47778, inspect your project dependencies for Sulu/sulu:

inspect dependencies for sulu/sulu

Analyze the terminal output to locate any version of Sulu/sulu in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.5.25), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-611: Improper Restriction of XML External Entity Reference, where the product processes an xml document that can contain xml entities with uris that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. In Sulu/sulu, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact A admin user can upload SVG which may load external data via XML DOM library, specially this can be used for eventually reference none secure XML External Entity References. ### Patches The problem has not been patched yet. Users should upgrade to patched versions once they become available. Currently affected versions are: - 2.6.9 - 2.5.25 - 3.0.0-alpha3 ### Workarounds Patch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` in sulu with: ```diff -$dom->loadXML($svg, \LIBXML_NOENT | \LIBXML_DTDLOAD); +$dom->loadXML($data, LIBXML_NONET); ``` ### References - GitHub repository: https://github.com/sulu/sulu - Vulnerable code: https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php

CVE-2025-47778 Affected Sulu/sulu Versions

3 component(s)

Fixed Versions:

2.5.252.6.93.0.0-alpha3

Product / Package	Ecosystem	Affected Versions	Fixed Version
sulu/sulu	Packagist	≥ 2.5.21 < 2.5.25	2.5.25
sulu/sulu	Packagist	≥ 2.6.5 < 2.6.9	2.6.9
sulu/sulu	Packagist	≥ 3.0.0-alpha1 < 3.0.0-alpha3	3.0.0-alpha3

References

GitHub Advisory / Wiki ADVISORY

https://github.com/sulu/sulu/security/advisories/GHSA-f6rx-hf55-4255

NVD — CVE-2025-47778 NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-47778

Security Fix Commit FIX COMMIT

https://github.com/sulu/sulu/commit/02f52fca04eb9495b9b4a0c5cc64cf23bc27f544

Sulu/sulu Source Repository REPOSITORY

https://github.com/sulu/sulu

Sulu/sulu Source Repository REPOSITORY

https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php

Frequently Asked Questions

What is CVE-2025-47778?

CVE-2025-47778 is a security vulnerability in Sulu/sulu involving Sulu vulnerable to XXE in SVG File upload Inspector under CWE-611: Improper Restriction of XML External Entity Reference.

Which Sulu/sulu versions are affected?

Affected versions include releases prior to 2.5.25, 2.6.9, 3.0.0-alpha3 across affected packages: sulu/sulu.

What version fixes CVE-2025-47778?

Upgrading to 2.5.25, 2.6.9, 3.0.0-alpha3 (or the latest patched release for your respective branch) resolves the vulnerability.

Is sulu/sulu affected?

Yes, sulu/sulu is affected in releases prior to 2.5.25, 2.6.9, 3.0.0-alpha3. Upgrade your dependency to 2.5.25, 2.6.9, 3.0.0-alpha3 or later.

What CWE is associated with CVE-2025-47778?

CVE-2025-47778 is classified under CWE-611: Improper Restriction of XML External Entity Reference (The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.).

How can I check Packagist dependencies for CVE-2025-47778?

Run the dependency tree command: 'inspect dependencies for sulu/sulu'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f6rx-hf55-4255",
  "modified" : "2025-05-15T16:08:02Z",
  "published" : "2025-05-15T16:08:02Z",
  "aliases" : [ "CVE-2025-47778" ],
  "summary" : "Sulu vulnerable to XXE in SVG File upload Inspector",
  "details" : "### Impact\n\nA admin user can upload SVG which may load external data via XML DOM library, specially this can be used for eventually reference none secure XML External Entity References.\n\n### Patches\n\nThe problem has not been patched yet. Users should upgrade to patched versions once they become available. Currently affected versions are:\n\n - 2.6.9\n - 2.5.25\n - 3.0.0-alpha3\n\n### Workarounds\n\nPatch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` in sulu with:\n\n```diff\n-$dom->loadXML($svg, \\LIBXML_NOENT | \\LIBXML_DTDLOAD);\n+$dom->loadXML($data, LIBXML_NONET);\n```\n\n### References\n\n - GitHub repository: https://github.com/sulu/sulu\n - Vulnerable code: https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "sulu/sulu"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.5.21"
      }, {
        "fixed" : "2.5.25"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "sulu/sulu"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.6.5"
      }, {
        "fixed" : "2.6.9"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "sulu/sulu"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0-alpha1"
      }, {
        "fixed" : "3.0.0-alpha3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/sulu/sulu/security/advisories/GHSA-f6rx-hf55-4255"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-47778"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sulu/sulu/commit/02f52fca04eb9495b9b4a0c5cc64cf23bc27f544"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/sulu/sulu"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-611" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-05-15T16:08:02Z",
    "nvd_published_at" : "2025-05-14T16:15:29Z"
  }
}

CVSS V4

N/A MODERATE

Attack Vector N/A

Attack Complexity N/A

Privileges Required N/A

User Interaction N/A

Scope N/A

Confidentiality N/A

Integrity N/A

Availability N/A

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Advisory Metadata

Source ID: GHSA-f6rx-hf55-4255
Schema Version: 1.4.0
Published: 2025-05-15 16:08
Last Modified: 2025-05-15 16:08
Database Record File: advisories/github-reviewed/2025/05/GHSA-f6rx-hf55-4255/GHSA-f6rx-hf55-4255.json