CVE-2025-48882
PHPOffice Math allows XXE when processing an XML file in the MathML format
概要
PHPOffice Math allows XXE when processing an XML file in the MathML format
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard libxml extension and the LIBXML_DTDLOAD flag without additional filtration, leads to XXE. Version 0.3.0 fixes the vulnerability.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com