CVE-2025-48882
PHPOffice Math allows XXE when processing an XML file in the MathML format
Résumé
PHPOffice Math allows XXE when processing an XML file in the MathML format
Description d'origine
La description telle que publiée par la source (souvent en anglais).
PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard libxml extension and the LIBXML_DTDLOAD flag without additional filtration, leads to XXE. Version 0.3.0 fixes the vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com