CVE-2025-48882CWE-611

PHPOffice Math allows XXE when processing an XML file in the MathML format

High · published May 30, 2025

CVSS v4.0
8.7
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard `libxml` extension and the `LIBXML_DTDLOAD` flag without additional filtration, leads to XXE. Version 0.3.0 fixes the vulnerability.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00476 · 40.1th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2025-05-30T19:43Z
EPSS history
Timeline
  • 30 MAY 19:43Z
    PHPOffice Math allows XXE when processing an XML file in the MathML format
    cvelistv5