High severity · published May 30, 2025
CVE-2025-48882
PHPOffice Math allows XXE when processing an XML file in the MathML format
8.7
CVSS
0.5%
EPSS
No
On KEV
Description
PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard `libxml` extension and the `LIBXML_DTDLOAD` flag without additional filtration, leads to XXE. Version 0.3.0 fixes the vulnerability.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Math · PHPOffice
< 0.3.0 · source: vendor