Executive brief
Tiptap for PHP is a library used to process and render rich text content. A vulnerability allows logged-in users to submit specially crafted data that crashes the server's content rendering system. This can lead to a permanent denial of service for specific pages or records, effectively breaking parts of the application until the corrupted data is manually removed from the database.
Technical details
An input validation vulnerability exists in Tiptap for PHP's Link::isAllowedUri() function. When processing Tiptap JSON, the library fails to verify that the 'attrs.href' field is a string before passing it to preg_match() or preg_replace(). If an attacker provides an array instead of a string, PHP throws an unhandled TypeError. Because this malformed data is often persisted in a database, the server-side HTML rendering pipeline (getHTML()) will consistently crash whenever the record is accessed, leading to a persistent denial of service. The issue is fixed in version 2.1.1 by adding a type check for the URI input.
Affected products
- ueberdosis tiptap-php < 2.1.1
Timeline
- 2026-06-12: patched: Fix merged in pull request #94 and released in version 2.1.1
- 2026-06-24: disclosed: CVE published and advisory released by VulnCheck