CVE-2026-47110
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Jun 24, 2026
CISA due date
—
The record
Tiptap for PHP before version 2.1.1 contains an input validation vulnerability that allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set to an array instead of a string, causing an unhandled TypeError in the Link::isAllowedUri() function when passed to preg_match(). Attackers can persist malformed JSON records that permanently crash the server-side HTML rendering pipeline for all subsequent viewers of that record until the database entry is manually repaired.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-73785 A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow… CWE-241
- CVE-2025-63548 An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a… CWE-241
- CVE-2025-66550 Nextcloud Calendar attachments of local files are offered to downloaded CWE-241
- CVE-2025-7339 on-headers is a node.js middleware for listening to when a response writes headers. CWE-241