CVE-2025-1219 in PHP
Summary
by MITRE • 03/30/2025
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 02/11/2026
This vulnerability affects PHP versions across multiple release lines including 8.1.x before 8.1.32, 8.2.x before 8.2.28, 8.3.x before 8.3.19, and 8.4.x before 8.4.5. The issue manifests when PHP's DOM or SimpleXML extensions process HTTP resources that undergo redirects during retrieval. The core technical flaw involves improper handling of charset detection when redirect responses are encountered, specifically using incorrect content-type headers to determine character encoding. This misconfiguration can lead to parsing errors where documents are interpreted with wrong character encodings, potentially causing applications to process malformed data or bypass security validations that depend on proper encoding detection. The vulnerability stems from a fundamental flaw in how PHP's XML parsing extensions handle HTTP redirect scenarios, creating a scenario where the original content-type header from the redirect response is not properly considered during charset determination.
The operational impact of this vulnerability extends beyond simple parsing errors to potentially enable security bypasses and data corruption scenarios. When applications rely on proper XML parsing for input validation or security checks, incorrect charset handling can allow malicious actors to craft payloads that appear valid but are actually malformed due to encoding confusion. This creates opportunities for bypassing input sanitization routines that depend on correct character set interpretation, potentially leading to injection attacks or other security exploits. The vulnerability particularly affects web applications that process external XML feeds or perform HTTP requests through DOMDocument or SimpleXMLElement objects, making it relevant to content management systems, data integration platforms, and any application that fetches and processes external XML resources through PHP's built-in XML extensions.
This vulnerability aligns with CWE-1084 which addresses improper handling of character encoding in XML processing, and relates to ATT&CK technique T1059.007 for input validation bypass through encoding manipulation. The issue represents a classic case of information disclosure and data integrity problems where the system's interpretation of character encoding can be manipulated through HTTP redirect behavior. Organizations should prioritize patching affected PHP installations to ensure proper charset handling during HTTP redirects, particularly in applications that process external XML data. Additionally, implementing proper input validation and sanitization routines that account for potential encoding issues can provide defense-in-depth against exploitation of this vulnerability. Security monitoring should include detection of unusual HTTP redirect patterns combined with XML processing activities, as these combinations may indicate attempted exploitation of the charset handling flaw. The vulnerability demonstrates the importance of proper HTTP protocol handling in security-critical components and underscores the need for comprehensive testing of redirect scenarios in XML processing libraries.