Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-105708: imgproxy allows remote cross-site scripting via SVG
CVE-2026-105708 · published 13 days ago
Summary
imgproxy versions up to 4.0.17 can be tricked when handling SVG images to insert code that runs in a visitor's web browser. An attacker can send a specially crafted SVG and cause the code to execute on any site that displays the image. Upgrade to a newer version or disable SVG processing until a fix is applied.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| – | imgproxy | 4.0.0 |
Original advisory text
imgproxy SVG svg.go sanitizeElement cross site scripting
A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
References
- https://vuldb.com/cve/CVE-2026-105708
- https://vuldb.com/submit/992216
- https://vuldb.com/vuln/413711
- https://vuldb.com/vuln/413711/cti
- https://github.com/imgproxy/imgproxy/issues/1708
- https://github.com/imgproxy/imgproxy/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-1057... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-105708 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
CWE-94Code Injection
Timeline
Published6 Oct 2026
Updated15 Oct 2026
First seen6 Oct 2026
Track software like this
Free during beta