CVE-2026-47110: Tiptap for PHP Denial-of-Service Vulnerability in Link Validation

Technical summary

The vulnerability exists in the Link::isAllowedUri() function within Tiptap for PHP, which lacks proper type validation before passing the attrs.href field to PHP's preg_match() function. The preg_match() function expects a string parameter; when attrs.href is an array, a TypeError is thrown and not caught. An authenticated attacker can craft a Tiptap JSON payload with attrs.href set to an array value, persist it to the database, and cause the HTML rendering pipeline to crash on any subsequent access. The defect is classified as improper input validation (CWE-241), specifically a failure to validate that user-supplied data conforms to expected type constraints before use in type-sensitive operations.

Business impact

This vulnerability creates a denial-of-service vector for any application using Tiptap for PHP to process and render user-submitted rich-text content. An authenticated attacker can corrupt database records with minimal effort, causing application crashes that affect all downstream users attempting to view that content. In collaborative editing environments, document management systems, or content platforms, this can disrupt workflow and damage user trust. The persistent nature of the attack—malformed data remains in the database until manually repaired—means impact continues beyond the initial attack unless preventive measures are in place.

Affected systems

Tiptap for PHP versions prior to 2.1.1 are vulnerable. Organizations using Tiptap for PHP in production environments, particularly those that accept user-submitted rich-text content and render it server-side, should inventory affected versions immediately. The vulnerability requires authenticated access, so it does not pose a risk from unauthenticated or anonymous users.

Exploitability

Exploitability is straightforward for authenticated users. No special tools, complex techniques, or race conditions are required. An attacker with valid credentials can craft a Tiptap JSON payload with a single line change (setting attrs.href to an array instead of a string) and submit it through normal application flows. The lack of error handling in the Link validation function means the attack succeeds reliably. However, the requirement for authentication limits the attack surface to insider threats, compromised user accounts, or applications that assign credentials too broadly.

Remediation

Upgrade Tiptap for PHP to version 2.1.1 or later. Verify the upgrade with your vendor's release notes to confirm the type-validation fix is included. If immediate patching is not possible, implement input validation at the application layer to enforce that attrs.href is a string before passing it to Tiptap's rendering pipeline, or add try-catch error handling around the Link validation call to prevent crashes. Monitor database entries for malformed Tiptap JSON; entries inserted before the patch will still cause crashes after upgrade and should be cleaned or repaired.

Patch guidance

Update Tiptap for PHP to version 2.1.1 or later. Check your package manager (Composer, npm, or equivalent) and your vendor's security advisory for the exact patched version number. Test the upgrade in a staging environment to ensure compatibility with your application and existing stored content before deploying to production. Once upgraded, consider running a database audit to identify and repair any corrupted Tiptap JSON records that may have been inserted by attackers.

Detection guidance

Monitor application logs for TypeError exceptions originating from Link::isAllowedUri() or preg_match() when processing Tiptap JSON. Track failed HTML rendering operations and look for patterns of failure associated with specific database records. Query the database for Tiptap JSON documents where the attrs.href field is an array rather than a string; these are indicators of malicious or corrupted payloads. In development or test environments, use fuzzing or automated testing to verify that the application gracefully handles type mismatches in Tiptap JSON inputs.

Why prioritize this

Although this is a MEDIUM-severity vulnerability, it should be treated as a priority for any organization using Tiptap for PHP in production. The vulnerability does not require advanced exploitation, affects the availability of critical functionality (content rendering), and creates persistent damage that impacts all users viewing affected records. Authenticated-only access limits scope, but the ease of exploitation combined with the business impact of prolonged outages justifies prompt patching.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability requiring authentication, with no confidentiality or integrity impact but high availability impact. The score appropriately captures the denial-of-service nature of the flaw. However, context matters: the persistence of malformed data in the database and the potential to affect multiple users viewing a single corrupted record may justify elevated priority in risk assessment beyond the base CVSS score.

Frequently asked questions