QwikSec

Security Database

CVE

CWE

Training

CVE-2025-48882

Published: May 30, 2025

Modified: May 30, 2025

PUBLISHED

Description

PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard `libxml` extension and the `LIBXML_DTDLOAD` flag without additional filtration, leads to XXE. Version 0.3.0 fixes the vulnerability.

Vendor	Product	Versions
PHPOffice	Math	affected `< 0.3.0`

Weaknesses (CWE)

References

https://github.com/PHPOffice/Math/security/advisories/GHSA-42hm-pq2f-3r7m

x_refsource_CONFIRM

https://github.com/PHPOffice/Math/commit/fc31c8f57a7a81f962cbf389fd89f4d9d06fc99a

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.