CVE-2026-47110

Tiptap for PHP before version 2.1.1 contains an input validation vulnerability that allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set to an array instead of a string, causing an unhandled TypeError in the Link::isAllowedUri() function when passed to preg_match(). Attackers can persist malformed JSON records that permanently crash the server-side HTML rendering pipeline for all subsequent viewers of that record until the database entry is manually repaired.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ueberdosis/tiptap-php/commit/74bfb7be1c8c6102b240f3879b7f984a6ab87b97
https://github.com/ueberdosis/tiptap-php/pull/94
https://github.com/ueberdosis/tiptap-php/releases/tag/2.1.1
https://www.vulncheck.com/advisories/tiptap-for-php-dos-via-malformed-href-attribute

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Tiptap para PHP antes de la versión 2.1.1 contiene una vulnerabilidad de validación de entrada que permite a atacantes autenticados causar una denegación de servicio al enviar JSON de Tiptap con el campo attrs.href configurado como un array en lugar de una cadena, causando un TypeError no manejado en la función Link::isAllowedUri() cuando se pasa a preg_match(). Los atacantes pueden persistir registros JSON malformados que bloquean permanentemente la canalización de renderizado HTML del lado del servidor para todos los espectadores posteriores de ese registro hasta que la entrada de la base de datos sea reparada manualmente.

Information

Published : 2026-06-24 22:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-47110

Mitre link : CVE-2026-47110

CVE.ORG link : CVE-2026-47110

JSON object : View

Products Affected

No product.

CWE

CWE-241

Improper Handling of Unexpected Data Type

{"id": "CVE-2026-47110", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47110", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-30T03:22:14.600403Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/ueberdosis/tiptap-php", "vendor": "ueberdosis", "product": "tiptap-php", "versions": [{"status": "affected", "version": "0", "lessThan": "2.1.1", "versionType": "semver"}], "packageURL": "pkg:github/ueberdosis/tiptap-php", "defaultStatus": "affected"}]}], "published": "2026-06-24T22:16:47.107", "references": [{"url": "https://github.com/ueberdosis/tiptap-php/commit/74bfb7be1c8c6102b240f3879b7f984a6ab87b97", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/ueberdosis/tiptap-php/pull/94", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/ueberdosis/tiptap-php/releases/tag/2.1.1", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/tiptap-for-php-dos-via-malformed-href-attribute", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-241"}]}], "descriptions": [{"lang": "en", "value": "Tiptap for PHP before version 2.1.1 contains an input validation vulnerability that allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set to an array instead of a string, causing an unhandled TypeError in the Link::isAllowedUri() function when passed to preg_match(). Attackers can persist malformed JSON records that permanently crash the server-side HTML rendering pipeline for all subsequent viewers of that record until the database entry is manually repaired."}, {"lang": "es", "value": "Tiptap para PHP antes de la versi\u00f3n 2.1.1 contiene una vulnerabilidad de validaci\u00f3n de entrada que permite a atacantes autenticados causar una denegaci\u00f3n de servicio al enviar JSON de Tiptap con el campo attrs.href configurado como un array en lugar de una cadena, causando un TypeError no manejado en la funci\u00f3n Link::isAllowedUri() cuando se pasa a preg_match(). Los atacantes pueden persistir registros JSON malformados que bloquean permanentemente la canalizaci\u00f3n de renderizado HTML del lado del servidor para todos los espectadores posteriores de ese registro hasta que la entrada de la base de datos sea reparada manualmente."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "disclosure@vulncheck.com"}