CVE-2022-34475

What it actually does

SVG <use> tags referencing same-origin documents bypass HTML Sanitizer API restrictions, enabling execution of attacker-controlled scripts from a same-origin JavaScript file.

Why it matters to the business

Attackers can perform cross-site scripting attacks that lead to unauthorized data access, session hijacking, or malicious actions within affected web applications, increasing risk for organizations using the vulnerable Pimcore versions.

How an attack unfolds

An attacker prepares a malicious SVG payload containing a <use> reference to a same-origin JavaScript file with executable script, submits it through an input sanitized by the HTML Sanitizer API, and achieves script execution in the victim's context.

How to fix it

Upgrade Pimcore to the fixed commit 0508c491c6a4f3d119ec8dcf444e52ff25028c36 or later; review and harden any custom HTML sanitization logic.

How to confirm the fix worked

Confirm the deployed Pimcore commit hash is 0508c491c6a4f3d119ec8dcf444e52ff25028c36 or newer; test SVG <use> inputs against the sanitizer to verify script execution is blocked.

Typical attack path

1. Identify an input vector processed by the HTML Sanitizer API in a Pimcore application
2. Craft SVG with <use> tag pointing to attacker-controlled same-origin JS containing payload
3. Submit sanitized input to trigger bypass
4. Execute arbitrary script in victim browser context

How to detect it

Review web server and application logs for unexpected script execution or anomalous SVG content containing <use> references; inspect browser console errors and network requests for same-origin JS file loads triggered by sanitized inputs.

What your security team should do

• Immediately upgrade all Pimcore instances to the patched commit
• Audit application inputs that use the HTML Sanitizer API for SVG content
• Implement additional output encoding and Content-Security-Policy headers as defense-in-depth
• Monitor EPSS trend and reassess exploit maturity