CVE-2025-1219: php_group php Inaccurate Source Code Comments

Vulnerability summary

CVE-2025-1219 is a medium (CVSS 6.3) Inaccurate Source Code Comments vulnerability in php_group php. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-03-2025
   PublishedVulnerability first disclosed.
2. 03-11-2025
   Last modifiedVulnerability information updated.

Description

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.

• CWE-1116Inaccurate Source Code CommentsThe source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.