Back to Database
Status published
High
CVE-2025-48882
PHPOffice Math allows XXE when processing an XML file in the MathML format
Vulnerability Description
PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard `libxml` extension and the `LIBXML_DTDLOAD` flag without additional filtration, leads to XXE. Version 0.3.0 fixes the vulnerability.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-48882
Credits & Attribution
No credits recorded in the NVD database.
References
More from PHPOffice
View All →CVE-2025-54370
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
High
8.7
CVE-2025-23210
Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet
Medium
4.8
CVE-2025-22131
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function
Medium
5.1
CVE-2024-56412
PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters
Medium
4.8
CVE-2024-56411
PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header
Medium
4.8
Affected Vendor
PHPOffice
View all reports →Affected Software
Math
Vulnerable Versions:
< 0.3.0
Timeline
Official Publish:
May 30th, 2025
Last Modified:
May 30th, 2025
Added to House:
July 22nd, 2026