Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

phpoffice/math

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7PackagistPublished

    PHPOffice Math allows XXE when processing an XML file in the MathML format

    CVE-2025-48882 · GHSA-42hm-pq2f-3r7m

    Affected
    • Packagist phpoffice/math <= 0.2.0
    Fixed in
    0.3.0· Vendor fix available
    Issue
    Product: Math Version: 0.2.0 CWE-ID: CWE-611: Improper Restriction of XML External Entity Reference CVSS vector v.4.0: 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) CVSS vector v.3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Description: An attacker can create a special XML file, during which it processed, external entities are loaded, and it’s possible to read local server files. Impact: Local server files reading Vulnerable component: The loadXML function with the unsafe LIBXMLDTDLOAD flag, the MathML class Exploitation conditions: The vulnerability applies only to reading a file in the MathML format. Mitigation: If there is no option to refuse using the LIBXMLDTDLOAD flag, it’s recommended to filter external entities through the implementation of the custom external entity loader function. Researcher: Aleksandr Zhurnakov (Positive Technologies) Research Zero-day vulnerability was discovered in the Math library in the detailed process of the XXE vulnerability…

    Recommended action: Upgrade to 0.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →