Medium severity6.5NVD Advisory· Published Feb 21, 2023· Updated Jun 17, 2026
CVE-2023-26267
CVE-2023-26267
Description
php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled via \LIBXML_DTDLOAD | \LIBXML_DTDATTR.
Affected products
3- cpe:2.3:a:php-saml-sp_project:php-saml-sp:*:*:*:*:*:*:*:*Range: <1.1.1
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <1.1.1, <2.1.1
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.