PT-2025-23222 · Phpoffice · Phpoffice Math
Aleksandr Zhurnakov
·
Published
2025-05-29
·
Updated
2025-07-07
·
CVE-2025-48882
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
PHPOffice Math versions prior to 0.3.0
Description
The issue allows an attacker to create a special XML file that, when processed, loads external entities, enabling the reading of local server files. This is due to the use of the
libxml extension with the LIBXML DTDLOAD flag without additional filtration. The vulnerability applies only to reading files in the MathML format.Recommendations
For versions prior to 0.3.0, update to version 0.3.0 or later to fix the vulnerability. As a temporary workaround, consider filtering external entities through the implementation of a custom external entity loader function, such as using
libxml set external entity loader, to minimize the risk of exploitation.Exploit
Fix
XXE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Phpoffice Math