p PatchFirst

CVE-2025-48882

CVE-2025-48882 · PHPOffice Math allows XXE when processing an XML file in the MathML format

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard `libxml` extension and the `LIBXML_DTDLOAD` flag without additional filtration, leads to XXE. Version 0.3.0 fixes the vulnerability.

CVSS 8.7 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • math

    Versions
    • < 0.3.0: Affected

    No fix published

  • phpoffice/math Packagist

    Versions
    • 0.1.0
    • 0.2.0
    Affected ranges
    • ECOSYSTEM: < 0.3.0

    Update to 0.3.0

Original sources

Check your server →