CVE-2025-1219

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its libxml extension connects the libxml2 library to PHP's stream layer, so that the DOM, SimpleXML and XMLReader extensions can load XML and HTML documents from URLs.

An Improper Input Validation vulnerability (CVE-2025-1219) has been identified in the libxml stream handling of PHP, which allows an attacker who controls a URL that an application loads with DOM or SimpleXML, or the target of a redirect from it, to make PHP decode the document with the charset of the wrong HTTP response, so that it may be parsed incorrectly or bypass validations. PHP tracks this issue as GHSA-p3x9-6h7p-cgfc.

Per MITRE CWE-20: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

This issue affects PHP 8.1 before 8.1.32, PHP 8.2 before 8.2.28, PHP 8.3 before 8.3.19 and PHP 8.4 before 8.4.5, as well as the End-of-Life release lines PHP 7.4 from 7.4.18 and PHP 8.0 from 8.0.5 through their final releases (7.4.33 and 8.0.30).

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/libxml)
• Affected versions: >=7.4.18 <=7.4.33, >=8.0.5 <=8.0.30, >=8.1.0 <8.1.32, >=8.2.0 <8.2.28, >=8.3.0 <8.3.19, >=8.4.0 <8.4.5
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.1.32, 8.2.28, 8.3.19, 8.4.5
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Medium-severity vulnerability is found in the libxml extension of PHP 8.1 before 8.1.32, 8.2 before 8.2.28, 8.3 before 8.3.19 and 8.4 before 8.4.5, and in the End-of-Life PHP 7.4 (from 7.4.18) and 8.0 (from 8.0.5) release lines, which never received the upstream fix. The PHP project scores it 6.3 under CVSS 4.0 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N).

When DOM, SimpleXML or XMLReader load a document from an http(s) URL, php_libxml_input_buffer_create_filename() opens it through PHP's HTTP stream wrapper and looks at the response headers for a Content-Type with a charset, which tells libxml2 how to decode the document. When the server answers with a redirect, the HTTP wrapper follows it and keeps the headers of every response in order. Before the fix, the function walked those headers from the start and stopped at the first Content-Type it found:

ZEND_HASH_FOREACH_VAL_IND(Z_ARRVAL(s->wrapperdata), header) {
    const char buf[] = "Content-Type:";
    if (Z_TYPE_P(header) == IS_STRING &&
            !zend_binary_strncasecmp(Z_STRVAL_P(header), Z_STRLEN_P(header), buf, sizeof(buf)-1, sizeof(buf)-1)) {
        char *needle = estrdup("charset=");
        char *haystack = estrndup(Z_STRVAL_P(header), Z_STRLEN_P(header));
        char *encoding = php_stristr(haystack, needle, Z_STRLEN_P(header), sizeof("charset=")-1);

For a redirected request, that first Content-Type belongs to the redirect response, not to the document that was finally delivered. The document is then decoded with a charset that its own server never declared. The CVE record warns that this may cause the document to be parsed incorrectly or to bypass validations, for example checks that an application or a filter performed on the document in its expected encoding.

Exploitation needs an application that loads XML or HTML from an http(s) URL with DOM, SimpleXML or XMLReader, with allow_url_fopen enabled, where the attacker controls the server, or a redirect target, and so the charsets in the responses. HeroDevs' analysis finds the issue reachable from any server API under those conditions. Applications that only load documents from local files or strings, or that disable allow_url_fopen, are not exposed.

The fix scans the response headers backwards and stops at the status line of the last response, so only a Content-Type sent with the final document is used to pick the charset.

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 7.4 and 8.0 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, fetch remote documents separately (for example with an HTTP client that reports the final response's headers), check the charset yourself, and pass the content to DOM or SimpleXML as a string, or disable allow_url_fopen if remote loading is not needed.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.1.32, 8.2.28, 8.3.19, 8.4.5, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Tim Düsterhus (finder, remediation)