CVE-2026-47110CWE-241

Tiptap for PHP < 2.1.1 DoS via Malformed href Attribute

High · published June 24, 2026

CVSS v4.0
7.1
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

Tiptap for PHP before version 2.1.1 contains an input validation vulnerability that allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set to an array instead of a string, causing an unhandled TypeError in the Link::isAllowedUri() function when passed to preg_match(). Attackers can persist malformed JSON records that permanently crash the server-side HTML rendering pipeline for all subsequent viewers of that record until the database entry is manually repaired.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00548 · 43.9th percentile
Weakness
CWE-241 · Improper Handling of Unexpected Data Type
Published
2026-06-24T21:21Z
EPSS history
Timeline
  • 24 JUN 21:21Z
    Tiptap for PHP < 2.1.1 DoS via Malformed href Attribute
    cvelistv5