CVE-2025-48882: PHPOffice Math XXE Vulnerability

CVE-2025-48882 Overview

CVE-2025-48882 is an XML External Entity (XXE) vulnerability in PHPOffice Math, a PHP library that manipulates formula file formats. Versions prior to 0.3.0 load XML data using the standard libxml extension with the LIBXML_DTDLOAD flag without additional filtration. Attackers can supply crafted XML documents that reference external entities, causing the parser to resolve those entities during processing. The flaw is tracked as [CWE-611: Improper Restriction of XML External Entity Reference]. Version 0.3.0 resolves the issue.

Critical Impact
Remote attackers can exfiltrate local files and internal network resources by submitting malicious XML formula files to applications that use PHPOffice Math for parsing.

Affected Products

PHPOffice Math versions prior to 0.3.0
PHP applications that ingest untrusted XML formula files via PHPOffice Math
Downstream PHPOffice consumers that delegate math formula parsing to this library

Discovery Timeline

2025-05-30 - CVE-2025-48882 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-48882

Vulnerability Analysis

The vulnerability resides in the XML parsing routines that handle math formula documents. PHPOffice Math calls libxml loaders with the LIBXML_DTDLOAD flag enabled. This flag instructs the parser to load Document Type Definitions referenced by the input document. The library does not disable external entity resolution or apply a deny list for external references.

An attacker who supplies a crafted formula file can declare an external entity that points to a local file path or a network URI. When PHPOffice Math parses the document, libxml resolves the entity and substitutes its content into the parsed tree. The resulting data flows back to the caller, exposing file contents or triggering outbound HTTP requests from the server.

Impact ranges from disclosure of sensitive files such as /etc/passwd or application configuration to server-side request forgery against internal services. The flaw is exploitable over the network without authentication or user interaction when the application accepts user-supplied math documents.

Root Cause

The root cause is unsafe configuration of the underlying libxml parser. PHPOffice Math passes LIBXML_DTDLOAD without pairing it with LIBXML_NONET or calling libxml_set_external_entity_loader to block external resolution. The fix in version 0.3.0 adjusts the loader so that DTD and entity processing no longer fetches external resources. See the upstream GitHub Math Commit and the GitHub Security Advisory GHSA-42hm-pq2f-3r7m for the corrective changes.

Attack Vector

The attack vector is network-based. An attacker uploads or submits a malicious XML formula file to any endpoint that hands the document to PHPOffice Math. The crafted document defines an external entity using the SYSTEM keyword that references either a local file URI or a remote URL. During parsing, the entity is resolved and its content is embedded in the parsed result, enabling data exfiltration or internal network probing.

Detection Methods for CVE-2025-48882

Indicators of Compromise

Inbound XML or office documents containing <!DOCTYPE declarations with SYSTEM or PUBLIC external entity references submitted to PHP application endpoints
PHP-FPM or web server processes initiating unexpected outbound HTTP, FTP, or file:// requests during document parsing
Application logs showing PHPOffice Math parsing operations followed by file read operations on sensitive paths such as /etc/passwd or application secrets
Errors from libxml referencing failed entity resolution against unusual hosts

Detection Strategies

Inspect uploaded XML and formula files for DOCTYPE declarations and external entity definitions before they reach the parser
Correlate web upload events with subsequent file-read or outbound connection telemetry from the PHP worker process
Audit dependency manifests such as composer.lock for phpoffice/math versions below 0.3.0
Deploy web application firewall rules that flag XML payloads containing SYSTEM, ENTITY, or file:// tokens

Monitoring Recommendations

Forward PHP, web server, and host process telemetry to a centralized analytics platform to correlate upload activity with file access and network egress
Alert on outbound connections from application servers to non-allowlisted destinations during XML processing
Track read access to credential stores, environment files, and SSH keys by web server user accounts
Maintain an inventory of applications using PHPOffice libraries and monitor for version drift

How to Mitigate CVE-2025-48882

Immediate Actions Required

Upgrade phpoffice/math to version 0.3.0 or later in all affected applications
Audit application code for direct calls to libxml loaders using LIBXML_DTDLOAD and replace them with safer flags
Restrict file upload endpoints to authenticated users and apply content-type validation before parsing
Review web server and PHP worker outbound network policies to block unintended egress

Patch Information

The PHPOffice Math maintainers fixed the issue in version 0.3.0. The remediation is published in GitHub Security Advisory GHSA-42hm-pq2f-3r7m and applied in commit fc31c8f57a7a81f962cbf389fd89f4d9d06fc99a. Update via Composer with composer require phpoffice/math:^0.3.0 and redeploy affected services.

Workarounds

Disable external entity loading globally by calling libxml_set_external_entity_loader(null) before invoking PHPOffice Math
Pair any required LIBXML_DTDLOAD usage with LIBXML_NONET to prevent network resolution of entities
Apply egress filtering on application hosts to deny outbound traffic except to required destinations
Reject inbound XML documents that contain a <!DOCTYPE declaration when applications do not require DTD processing

bash

# Configuration example
composer require phpoffice/math:^0.3.0
composer update phpoffice/math