IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-05-30 20:15

MODIFIED

2025-06-02 17:32

EPSS (Prob. Exploit)

0.50%

Top 57.2%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-11 OSV 🔗 2026-11-08

> DESCRIPTION

PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard `libxml` extension and the `LIBXML_DTDLOAD` flag without additional filtration, leads to XXE. Version 0.3.0 fixes the vulnerability.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-42hm-pq2f-3r7m HIGH

PHPOffice Math allows XXE when processing an XML file in the MathML format

AFFECTED PACKAGES:

COMPOSER / phpoffice/math

<= 0.2.0

Fixed in: 0.3.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

PHPOffice Math allows XXE when processing an XML file in the MathML format

AFFECTED PACKAGES:

Unknown / Unknown

2 versions affected

ALIASES:

GHSA-42hm-pq2f-3r7m

> HISTORIQUE DES MODIFICATIONS

Première apparition

30/05/2025 20:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:04

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui