All vulnerabilities
CVE-2026-47110GHSA-4595-7fjw-r3jh

ueberdosis/tiptap-php: Tiptap contains an input validation vulnerability resulting in DoS

ueberdosis ueberdosis/tiptap-phpcomposerRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.55%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.1.1Fixed versionGitHub
Published24 Jun 2026Updated 7 Oct 2026CVE List

What fixes it

  • 2.1.1ueberdosis/tiptap-php, composerGitHubcomposer require "ueberdosis/tiptap-php:^2.1.1"
  • 2.1.1tiptap-phpCVE List
  • 2.1.1ueberdosis/tiptap-php, PackagistOSVcomposer require "ueberdosis/tiptap-php:^2.1.1"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Tiptap for PHP before version 2.1.1 contains an input validation vulnerability that allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set to an array instead of a string, causing an unhandled TypeError in the Link::isAllowedUri() function when passed to preg_match(). Attackers can persist malformed JSON records that permanently crash the server-side HTML rendering pipeline for all subsequent viewers of that record until the database entry is manually repaired.

Text from CVE List

Affected versions 10

  • ueberdosis/tiptap-php, composer< 2.1.1GitHub
  • tiptap-phpaffected: all versions before 2.1.1CVE List
  • ueberdosis/tiptap-php, Packagistfrom first release, fixed in 2.1.1OSV
  • ueberdosis/tiptap-php, Packagist1.0.0OSV
  • ueberdosis/tiptap-php, Packagist1.1.0OSV
  • ueberdosis/tiptap-php, Packagist1.2.0OSV
  • ueberdosis/tiptap-php, Packagist1.3.0OSV
  • ueberdosis/tiptap-php, Packagist1.4.0OSV
  • ueberdosis/tiptap-php, Packagist2.0.0OSV
  • ueberdosis/tiptap-php, Packagist2.1.0OSV

References 6