Cyber Resilience

CVE-2025-1219

Php 8.1.0 – 8.1.32

Public PoC
Published
30 March 2025
Modified
03 November 2025
Patch / advisory
CVSS Score v4 6.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0072 50th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-1219 is a medium-severity Inaccurate Source Code Comments (CWE-1116) vulnerability in Php Php. Its CVSS base score is 6.3 (Medium).

Operationally, ranked in the top 50% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and CM-6 (Configuration Settings) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when…

more

the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.

CWE(s)

Related Threats

CVEs Like This One

CVE-2023-0567Same product: Php Php
CVE-2026-7258Same product: Php Php
CVE-2024-11234Same product: Php Php
CVE-2023-3247Same product: Php Php
CVE-2024-11233Same product: Php Php
CVE-2026-6735Same product: Php Php
CVE-2025-1220Same product: Php Php
CVE-2026-7263Same product: Php Php
CVE-2025-14179Same product: Php Php
CVE-2024-11235Same product: Php Php

Affected Assets

php
php
8.1.0 — 8.1.32 · 8.2.0 — 8.2.28 · 8.3.0 — 8.3.19

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
  • CM-6 Configuration Settings
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires timely installation of PHP security updates that correct the redirect charset-handling flaw in DOM/SimpleXML.

prevent

Allows organization-defined secure PHP configuration settings (e.g., disabling unused XML extensions or enforcing strict parsing) that reduce exposure to the mis-parsing behavior.

detect

Provides integrity verification of PHP binaries/libraries to detect unauthorized or vulnerable versions that contain the charset-handling defect.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
prevents

Secure SDLC practices include code review and documentation standards that catch inaccurate comments.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure development life cycle includes code review and documentation standards that reduce inaccurate comments.

prevents

Secure coding practices typically mandate accurate, up-to-date comments as part of coding standards.

none

Documented operating procedures may reference code comments, encouraging their accuracy for operational consistency.

none

Security testing can indirectly catch misleading comments when they cause test failures or misinterpretation.

none

Change management processes require documentation updates, indirectly ensuring comment accuracy after modifications.

References