Which versions of Tiptap for PHP are affected by EUVD-2026-39100?

Tiptap for PHP before version 2.1.1 contains a persistent denial of service vulnerability exploitable by authenticated users; no public exploit has been identified at time of analysis.. A patch is available.

How to fix or mitigate EUVD-2026-39100?

Within 24 hours: audit current Tiptap for PHP version deployed in production and identify all affected instances. Within 7 days: apply vendor-released patch to upgrade to Tiptap for PHP 2.1.1 across all affected systems. Within 30 days: conduct full database audit to identify and remediate any existing malformed records that may have been stored prior to patching.

Tiptap for PHP EUVD-2026-39100

Q: What is the CVSS score of EUVD-2026-39100?

EUVD-2026-39100 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-47110 HIGH

Improper Handling of Unexpected Data Type (CWE-241)

2026-06-24 VulnCheck

GHSA-4595-7fjw-r3jh

Denial Of Service PHP Tiptap Php

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Remote submission with low complexity, but persisting content requires an authenticated low-privilege account (PR:L); impact is availability-only (A:H) with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 24, 2026 - 22:18 vuln.today

Analysis Generated

Jun 24, 2026 - 22:18 vuln.today

DescriptionCVE.org

Tiptap for PHP before version 2.1.1 contains an input validation vulnerability that allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set to an array instead of a string, causing an unhandled TypeError in the Link::isAllowedUri() function when passed to preg_match(). Attackers can persist malformed JSON records that permanently crash the server-side HTML rendering pipeline for all subsequent viewers of that record until the database entry is manually repaired.

Articles & Coverage 1

News 8 New PHP Vulnerabilities - 1 Critical, 7 High, 2 With POC Jun 25, 2026

AnalysisAI

Persistent denial of service in the Tiptap for PHP library before 2.1.1 lets authenticated users crash the server-side rendering pipeline by submitting Tiptap JSON whose attrs.href is an array rather than a string. The malformed value reaches preg_match() inside Link::isAllowedUri() and triggers an unhandled TypeError; because the bad record is stored, every later attempt to render that content fails for all viewers until the database row is manually fixed. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

Tiptap for PHP (ueberdosis/tiptap-php) is the PHP server-side counterpart to the Tiptap rich-text editor framework, responsible for converting Tiptap's JSON document model into HTML. The Link extension enforces a URI allow-list through Link::isAllowedUri(), which passes the href attribute to PHP's preg_match(). The code assumes href is always a string, but Tiptap JSON is attacker-controllable and can carry attrs.href as an array. preg_match() requires a string subject, so an array argument raises a TypeError that is not caught anywhere in the rendering path. This maps to CWE-241 (Improper Handling of Unexpected Data Type): the defect is a missing type check on externally supplied structured input rather than a memory-safety or injection bug.

RemediationAI

Vendor-released patch: upgrade ueberdosis/tiptap-php to version 2.1.1 or later (via Composer), which adds a type guard preventing the TypeError when a link href is not a string (PR https://github.com/ueberdosis/tiptap-php/pull/94, commit 74bfb7be1c8c6102b240f3879b7f984a6ab87b97, release https://github.com/ueberdosis/tiptap-php/releases/tag/2.1.1). If you cannot upgrade immediately, validate or normalize incoming Tiptap JSON before persistence by rejecting or coercing any attrs.href that is not a scalar string, which blocks the malformed input at the application boundary at the cost of adding custom input-validation code that must be kept in sync with the schema. As a recovery measure for an already-affected deployment, identify and repair or delete stored records whose href fields are arrays to restore rendering; wrap the rendering call in error handling only as a stopgap, since catching the TypeError hides the bad data rather than fixing it. See the VulnCheck advisory (https://www.vulncheck.com/advisories/tiptap-for-php-dos-via-malformed-href-attribute) for confirmation of affected versions and fix.