CVE-2025-14180

High

Advisory

Published 27 Dec 2025In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 8; of 17,781 indexed, latest versions
Container images: 7; deployed by those charts
Fix available: 5 of 5; affected packages

NULL Pointer Dereference in PDO quoting

Carried by container images the latest versions of 8 of 17,781 indexed charts deploy, on 7 images.

Affected package	Affected versions	Fixed in	Images
libphpbitnami	7.4.33-1, 8.2.29-5	8.1.34	2
phpbitnami	7.4.33-2, 8.2.29-4	8.1.34	2
php8.1deb	8.1.2-1ubuntu2.3, 8.1.2-1ubuntu2.14	8.1.2-1ubuntu2.23	2
php8.3deb	8.3.6-0ubuntu0.24.04.3, 8.3.6-0ubuntu0.24.04.5	8.3.6-0ubuntu0.24.04.6	2
php8.2deb	8.2.7-1~deb12u1	8.2.30-1~deb12u1	1

OSV records: BIT-libphp-2025-14180 BIT-php-2025-14180 DEBIAN-CVE-2025-14180 UBUNTU-CVE-2025-14180
Also known as: BIT-php-min-2025-14180, GHSA-8xr5-qppj-gvwj, USN-7953-1

Charts affected

8 by stars

Chart

Latest

Affected images

Radar Score

zabbixcetic

3.1.3

1 of 5 See more

zabbix cetic 3.1.3

1 of the 5 container images this version deploys carry CVE-2025-14180.

Container image	Digest	Package	Fixed in
zabbix/zabbix-web-nginx-pgsql :ubuntu-6.0.8	99e9a090b516	php8.1@8.1.2-1ubuntu2.3	8.1.2-1ubuntu2.23

Open the chart page →

33,725

zabbix-server-mysqlfermosit

3.0.2

1 of 4 See more

zabbix-server-mysql fermosit 3.0.2

1 of the 4 container images this version deploys carry CVE-2025-14180.

Container image	Digest	Package	Fixed in
zabbix/zabbix-web-nginx-mysql :ubuntu-6.4-latest	0e5f69c4c54e	php8.3@8.3.6-0ubuntu0.24.04.3	8.3.6-0ubuntu0.24.04.6

Open the chart page →

12,840

equizequiz

0.0.1

1 of 3 See more

equiz equiz 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-14180.

Container image	Digest	Package	Fixed in
yzhou442/equiz :latest	a3f7ca69e28d	libphp@7.4.33-1 php@7.4.33-2	8.1.34 8.1.34

Open the chart page →

7,541

equizequiz-chart

0.0.1

1 of 3 See more

equiz equiz-chart 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-14180.

Container image	Digest	Package	Fixed in
yzhou442/equiz :latest	a3f7ca69e28d	libphp@7.4.33-1 php@7.4.33-2	8.1.34 8.1.34

Open the chart page →

7,541

nominatimheywood8-helm-charts

3.10.8

1 of 3 See more

nominatim heywood8-helm-charts 3.10.8

1 of the 3 container images this version deploys carry CVE-2025-14180.

Container image	Digest	Package	Fixed in
mediagis/nominatim :4.2	d0eae7b51374	php8.1@8.1.2-1ubuntu2.14	8.1.2-1ubuntu2.23

Open the chart page →

14,290

kc-chartkc-chart

1.0.0

1 of 3 See more

kc-chart kc-chart 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-14180.

Container image	Digest	Package	Fixed in
jhoncytech/bookworm-apache-wordpress :latest	18c3ca1f411e	php8.2@8.2.7-1~deb12u1	8.2.30-1~deb12u1

Open the chart page →

8,860

matomopetbattle

11.0.1

1 of 2 See more

matomo petbattle 11.0.1

1 of the 2 container images this version deploys carry CVE-2025-14180.

Container image	Digest	Package	Fixed in
bitnamilegacy/matomo :5.3.2-debian-12-r13	f02c000c54b1	libphp@8.2.29-5 php@8.2.29-4	8.1.34 8.1.34

Open the chart page →

11,061

snipeitschmitzis

6.1.0

1 of 2 See more

snipeit schmitzis 6.1.0

1 of the 2 container images this version deploys carry CVE-2025-14180.

Container image	Digest	Package	Fixed in
snipe/snipe-it :v8.3.1	141ebf2386fe	php8.3@8.3.6-0ubuntu0.24.04.5	8.3.6-0ubuntu0.24.04.6

Open the chart page →

6,094

Container images carrying it

7 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
yzhou442/equiz :latest	a3f7ca69e28d	libphp@7.4.33-1 php@7.4.33-2	8.1.34 8.1.34	2
bitnamilegacy/matomo :5.3.2-debian-12-r13	f02c000c54b1	libphp@8.2.29-5 php@8.2.29-4	8.1.34 8.1.34	1
jhoncytech/bookworm-apache-wordpress :latest	18c3ca1f411e	php8.2@8.2.7-1~deb12u1	8.2.30-1~deb12u1	1
mediagis/nominatim :4.2	d0eae7b51374	php8.1@8.1.2-1ubuntu2.14	8.1.2-1ubuntu2.23	1
snipe/snipe-it :v8.3.1	141ebf2386fe	php8.3@8.3.6-0ubuntu0.24.04.5	8.3.6-0ubuntu0.24.04.6	1
zabbix/zabbix-web-nginx-mysql :ubuntu-6.4-latest	0e5f69c4c54e	php8.3@8.3.6-0ubuntu0.24.04.3	8.3.6-0ubuntu0.24.04.6	1
zabbix/zabbix-web-nginx-pgsql :ubuntu-6.0.8	99e9a090b516	php8.1@8.1.2-1ubuntu2.3	8.1.2-1ubuntu2.23	1