CVE-2023-26267: PHP-SAML-SP Project PHP-SAML-SP

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled via \LIBXML_DTDLOAD | \LIBXML_DTDATTR.

Affected products

• PHP-SAML-SP Project PHP-SAML-SP: before 1.1.1 (fixed in 1.1.1); from 2.0.0, before 2.1.1 (fixed in 2.1.1)

Published 2023-02-21. Last modified 2026-06-17.