CVE-2026-47110

Name of the Vulnerable Software and Affected Versions Tiptap for PHP versions prior to 2.1.1

Description An input validation issue allows authenticated attackers to cause a denial of service. By submitting Tiptap JSON where the attrs.href field is set as an array instead of a string, an unhandled TypeError is triggered in the isAllowedUri() function when the value is passed to preg match(). This allows attackers to persist malformed JSON records that permanently crash the server-side HTML rendering pipeline for all subsequent viewers of that record until the database entry is manually repaired.

Recommendations Update Tiptap for PHP to version 2.1.1 or later.