CVE-2025-1219
Php 8.1.0 – 8.1.32
Raw vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-1219 is a medium-severity Inaccurate Source Code Comments (CWE-1116) vulnerability in Php Php. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 50% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and CM-6 (Configuration Settings) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-15126
Vulnerability Data
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when…
more
the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of PHP security updates that correct the redirect charset-handling flaw in DOM/SimpleXML.
Allows organization-defined secure PHP configuration settings (e.g., disabling unused XML extensions or enforcing strict parsing) that reduce exposure to the mis-parsing behavior.
Provides integrity verification of PHP binaries/libraries to detect unauthorized or vulnerable versions that contain the charset-handling defect.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices include code review and documentation standards that catch inaccurate comments.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development life cycle includes code review and documentation standards that reduce inaccurate comments.
Secure coding practices typically mandate accurate, up-to-date comments as part of coding standards.
Documented operating procedures may reference code comments, encouraging their accuracy for operational consistency.
Security testing can indirectly catch misleading comments when they cause test failures or misinterpretation.
Change management processes require documentation updates, indirectly ensuring comment accuracy after modifications.