CVE-2025-1219 libxml streams use wrong content-type header when requesting a redirected resource
Incorrect content-type handling during HTTP redirects in PHP XML extensions may cause parsing errors or bypass security validations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-1219?
CVE-2025-1219 is a medium-severity vulnerability in Php Php, published on 30 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.
Weakness: CWE-1116
Which versions are affected by CVE-2025-1219?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | All versions | 8.1.32, 8.2.28, 8.3.19, 8.4.5 |
php Bitnami | All versions | 8.1.32, 8.2.28, 8.3.19, 8.4.5 |
php-min Bitnami | All versions | 8.1.32, 8.2.28, 8.3.19, 8.4.5 |
Products include Php Php.
How do I fix CVE-2025-1219?
Upgrade libphp to a fixed version for your release line: 8.1.32, 8.2.28, 8.3.19 or 8.4.5.
Is CVE-2025-1219 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-1219 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Php Php
Sources
Also known as AZL-59300, AZL-59316, BELL-CVE-2025-1219, BIT-libphp-2025-1219, BIT-php-2025-1219, BIT-php-min-2025-1219 and 9 more.