cve/2023/CVE-2023-27586.md

### [CVE-2023-27586](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27586)
![](https://img.shields.io/static/v1?label=Product&message=CairoSVG&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%202.7.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brighgreen)

### Description

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.

### POC

#### Reference
- https://github.com/Kozea/CairoSVG/security/advisories/GHSA-rwmf-w63j-p7gv

#### Github
- https://github.com/karimhabush/cyberowl