CVE-2025-48882
PHPOffice Math allows XXE when processing an XML file in the MathML format
Summary
PHPOffice Math allows XXE when processing an XML file in the MathML format
Original description
The description as published by the source.
PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard libxml extension and the LIBXML_DTDLOAD flag without additional filtration, leads to XXE. Version 0.3.0 fixes the vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com