StackRadar

CVE-2025-14178

High

Advisory

Published 27 Dec 2025In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
22
of 17,781 indexed, latest versions
Container images
18
deployed by those charts
Fix available
6 of 6
affected packages

Heap buffer overflow in array_merge()

Carried by container images the latest versions of 22 of 17,781 indexed charts deploy, on 18 images.

Affected packageAffected versionsFixed inImages
libphpbitnami7.4.33-1, 8.2.29-58.1.342
phpbitnami7.4.33-2, 8.2.29-48.1.342
php8.2deb8.2.7-1~deb12u18.2.30-1~deb12u11
php7.4deb7.4.3-4ubuntu2.6, 7.4.3-4ubuntu2.12, 7.4.3-4ubuntu2.13, 7.4.3-4ubuntu2.15+7 more7.4.3-4ubuntu2.29+esm3, 7.4.33-1+deb11u1011
php8.1deb8.1.2-1ubuntu2.3, 8.1.2-1ubuntu2.148.1.2-1ubuntu2.232
php8.3deb8.3.6-0ubuntu0.24.04.3, 8.3.6-0ubuntu0.24.04.58.3.6-0ubuntu0.24.04.62
OSV records
BIT-libphp-2025-14178BIT-php-2025-14178DEBIAN-CVE-2025-14178UBUNTU-CVE-2025-14178DLA-4447-1
Also known as
BIT-php-min-2025-14178, GHSA-h96m-rvf9-jgm2, USN-7953-1

Charts affected

22 by stars
ChartLatestAffected imagesRadar Score
zabbixcetic3.1.31 of 5See more

zabbix cetic 3.1.3

1 of the 5 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
zabbix/zabbix-web-nginx-pgsql:ubuntu-6.0.899e9a090b516
php8.1@8.1.2-1ubuntu2.3
8.1.2-1ubuntu2.23

Open the chart page →

33,725
snipeitt3n3.4.11 of 2See more

snipeit t3n 3.4.1

1 of the 2 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
snipe/snipe-it:v6.0.1455fb7636a98c
php7.4@7.4.3-4ubuntu2.13
7.4.3-4ubuntu2.29+esm3

Open the chart page →

18,509
adminercetic0.2.11 of 1See more

adminer cetic 0.2.1

1 of the 1 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
library/adminer:4.8.1-standalone34d37131366c
php7.4@7.4.33-1+deb11u5
7.4.33-1+deb11u10

Open the chart page →

461
zabbix-serveraekondratievVerified publisher1.0.61 of 4See more

zabbix-server aekondratiev 1.0.6

1 of the 4 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
zabbix/zabbix-web-nginx-pgsql:ubuntu-5.4.601de79c31391
php7.4@7.4.3-4ubuntu2.6
7.4.3-4ubuntu2.29+esm3

Open the chart page →

30,668
passboltcnieg1.1.171 of 2See more

passbolt cnieg 1.1.17

1 of the 2 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
passbolt/passbolt:3.4.0-ce-non-root655547e17263
php7.4@7.4.25-1+deb11u1
7.4.33-1+deb11u10

Open the chart page →

3,543
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
library/adminer:4.8.1-standalone34d37131366c
php7.4@7.4.33-1+deb11u5
7.4.33-1+deb11u10

Open the chart page →

52,919
piholesavepointsamVerified publisher0.2.01 of 1See more

pihole savepointsam 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
pihole/pihole:2023.05.0b83258064f54
php7.4@7.4.33-1+deb11u3
7.4.33-1+deb11u10

Open the chart page →

1,048
passbolt-hachristianhuthVerified publisher6.0.11 of 4See more

passbolt-ha christianhuth 6.0.1

1 of the 4 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
passbolt/passbolt:3.4.0-ce-non-root655547e17263
php7.4@7.4.25-1+deb11u1
7.4.33-1+deb11u10

Open the chart page →

10,817
zabbix-server-mysqlfermosit3.0.21 of 4See more

zabbix-server-mysql fermosit 3.0.2

1 of the 4 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
zabbix/zabbix-web-nginx-mysql:ubuntu-6.4-latest0e5f69c4c54e
php8.3@8.3.6-0ubuntu0.24.04.3
8.3.6-0ubuntu0.24.04.6

Open the chart page →

12,840
openldapcsic-charts0.1.11 of 2See more

openldap csic-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
ldapaccountmanager/lam:8.0.1d46cf25d1dda
php7.4@7.4.30-1+deb11u1
7.4.33-1+deb11u10

Open the chart page →

5,293
equizequiz0.0.11 of 3See more

equiz equiz 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
yzhou442/equiz:latesta3f7ca69e28d
libphp@7.4.33-1
php@7.4.33-2
8.1.34
8.1.34

Open the chart page →

7,541
equizequiz-chart0.0.11 of 3See more

equiz equiz-chart 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
yzhou442/equiz:latesta3f7ca69e28d
libphp@7.4.33-1
php@7.4.33-2
8.1.34
8.1.34

Open the chart page →

7,541
passboltg0dscookie0.5.21 of 2See more

passbolt g0dscookie 0.5.2

1 of the 2 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
passbolt/passbolt:3.9.0-2-ce-non-rootec046e112d5c
php7.4@7.4.33-1+deb11u1
7.4.33-1+deb11u10

Open the chart page →

7,940
nominatimheywood8-helm-chartsVerified publisher3.10.81 of 3See more

nominatim heywood8-helm-charts 3.10.8

1 of the 3 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
mediagis/nominatim:4.2d0eae7b51374
php8.1@8.1.2-1ubuntu2.14
8.1.2-1ubuntu2.23

Open the chart page →

14,290
kc-chartkc-chart1.0.01 of 3See more

kc-chart kc-chart 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
jhoncytech/bookworm-apache-wordpress:latest18c3ca1f411e
php8.2@8.2.7-1~deb12u1
8.2.30-1~deb12u1

Open the chart page →

8,860
phppgadminkfirfer0.1.121 of 1See more

phppgadmin kfirfer 0.1.12

1 of the 1 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
kfirfer/phppgadmin:7.13.0-22efb4a5d74a3
php7.4@7.4.3-4ubuntu2.15
7.4.3-4ubuntu2.29+esm3

Open the chart page →

10,248
nominatimnominatim-chart1.3.01 of 3See more

nominatim nominatim-chart 1.3.0

1 of the 3 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
mediagis/nominatim:3.7c15e941485ef
php7.4@7.4.3-4ubuntu2.12
7.4.3-4ubuntu2.29+esm3

Open the chart page →

22,658
openldapopenldap0.1.11 of 2See more

openldap openldap 0.1.1

1 of the 2 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
ldapaccountmanager/lam:8.0.1d46cf25d1dda
php7.4@7.4.30-1+deb11u1
7.4.33-1+deb11u10

Open the chart page →

5,293
matomopetbattle11.0.11 of 2See more

matomo petbattle 11.0.1

1 of the 2 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
bitnamilegacy/matomo:5.3.2-debian-12-r13f02c000c54b1
libphp@8.2.29-5
php@8.2.29-4
8.1.34
8.1.34

Open the chart page →

11,061
snipeitschmitzis6.1.01 of 2See more

snipeit schmitzis 6.1.0

1 of the 2 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
snipe/snipe-it:v8.3.1141ebf2386fe
php8.3@8.3.6-0ubuntu0.24.04.5
8.3.6-0ubuntu0.24.04.6

Open the chart page →

6,094
icingawebsvtech-public-helm-charts1.0.01 of 2See more

icingaweb svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
svtechnmaa/svtech_icingaweb2:v1.0.2a59d0b81dde2
php7.4@7.4.33-1+deb11u4
7.4.33-1+deb11u10

Open the chart page →

2,038
owncloudth-chartsVerified publisher0.2.11 of 1See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2025-14178.

Container imageDigestPackageFixed in
owncloud/server:10.15.051d9b74fc2a8
php7.4@7.4.3-4ubuntu2.23
7.4.3-4ubuntu2.29+esm3

Open the chart page →

10,006

Container images carrying it

18 by charts deploying them

A fixed version is listed for 6 of the 6 affected packages.

Container imageDigestPackageFixed inUsed by
ldapaccountmanager/lam:8.0.1d46cf25d1dda
php7.4@7.4.30-1+deb11u1
7.4.33-1+deb11u10
2
library/adminer:4.8.1-standalone34d37131366c
php7.4@7.4.33-1+deb11u5
7.4.33-1+deb11u10
2
passbolt/passbolt:3.4.0-ce-non-root655547e17263
php7.4@7.4.25-1+deb11u1
7.4.33-1+deb11u10
2
yzhou442/equiz:latesta3f7ca69e28d
libphp@7.4.33-1
php@7.4.33-2
8.1.34
8.1.34
2
bitnamilegacy/matomo:5.3.2-debian-12-r13f02c000c54b1
libphp@8.2.29-5
php@8.2.29-4
8.1.34
8.1.34
1
jhoncytech/bookworm-apache-wordpress:latest18c3ca1f411e
php8.2@8.2.7-1~deb12u1
8.2.30-1~deb12u1
1
kfirfer/phppgadmin:7.13.0-22efb4a5d74a3
php7.4@7.4.3-4ubuntu2.15
7.4.3-4ubuntu2.29+esm3
1
mediagis/nominatim:3.7c15e941485ef
php7.4@7.4.3-4ubuntu2.12
7.4.3-4ubuntu2.29+esm3
1
mediagis/nominatim:4.2d0eae7b51374
php8.1@8.1.2-1ubuntu2.14
8.1.2-1ubuntu2.23
1
owncloud/server:10.15.051d9b74fc2a8
php7.4@7.4.3-4ubuntu2.23
7.4.3-4ubuntu2.29+esm3
1
passbolt/passbolt:3.9.0-2-ce-non-rootec046e112d5c
php7.4@7.4.33-1+deb11u1
7.4.33-1+deb11u10
1
pihole/pihole:2023.05.0b83258064f54
php7.4@7.4.33-1+deb11u3
7.4.33-1+deb11u10
1
snipe/snipe-it:v8.3.1141ebf2386fe
php8.3@8.3.6-0ubuntu0.24.04.5
8.3.6-0ubuntu0.24.04.6
1
snipe/snipe-it:v6.0.1455fb7636a98c
php7.4@7.4.3-4ubuntu2.13
7.4.3-4ubuntu2.29+esm3
1
svtechnmaa/svtech_icingaweb2:v1.0.2a59d0b81dde2
php7.4@7.4.33-1+deb11u4
7.4.33-1+deb11u10
1
zabbix/zabbix-web-nginx-mysql:ubuntu-6.4-latest0e5f69c4c54e
php8.3@8.3.6-0ubuntu0.24.04.3
8.3.6-0ubuntu0.24.04.6
1
zabbix/zabbix-web-nginx-pgsql:ubuntu-5.4.601de79c31391
php7.4@7.4.3-4ubuntu2.6
7.4.3-4ubuntu2.29+esm3
1
zabbix/zabbix-web-nginx-pgsql:ubuntu-6.0.899e9a090b516
php8.1@8.1.2-1ubuntu2.3
8.1.2-1ubuntu2.23
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.