PT-2025-5634 · Unknown · Php-Textile

Published 2025-01-07 · Updated 2025-01-07

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: PHP-Textile versions 4.1.2 and older

Description: A persistent XSS issue exists in the image link handling of PHP-Textile when running the parser in restricted mode. This mode is expected to sanitize input, allowing safe handling of user-input. However, in restricted mode, version 4.1.2 of the library fails to sanitize or validate user-controllable href input in image links, allowing any link protocol or JavaScript links to be used. An attacker can add malicious JavaScript code to the page, which is executed when an unsuspecting user clicks the link.

Recommendations: For PHP-Textile versions 4.1.2 and older, update to version 4.1.3, which disallows the use of JavaScript in image links when the parser is run in restricted mode. To enable restricted mode, use the Parser::setRestricted() method prior to calling the parse method.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-95M2-CHM4-MQ7M

Affected Products

Php-Textile

References · 4

• https://osv.dev/vulnerability/GHSA-95m2-chm4-mq7m · Vendor Advisory
• https://github.com/textile/php-textile · Note
• https://github.com/textile/php-textile/commit/ab18ae9703bee8b15f1b9d889d40e1881728bae6 · Note
• https://github.com/textile/php-textile/security/advisories/GHSA-95m2-chm4-mq7m · Note