What is CVE-2025-48882?

CVE-2025-48882 is a vulnerability in Phpoffice Math, classified under Improper Restriction of XML External Entity Reference (XXE). Published 2025-05-30.

Is CVE-2025-48882 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XXE in Phpoffice Math

CVE-2025-48882

PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard `libxml` extension and the `LIBXML_DTDLOAD` flag without additional filtration, leads to XXE. Version 0.3.0 fixes the vulnerability.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.004 (34.2th percentile) — read the EPSS interpretation.

Affected products

Phpoffice Math — versions < 0.3.0

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-48882?: CVE-2025-48882 is a vulnerability in Phpoffice Math, classified under Improper Restriction of XML External Entity Reference (XXE). Published 2025-05-30.
Is CVE-2025-48882 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.