CVE-2026-48157

Vulnerability

Slim PHP framework versions 4.4.0 through 4.15.1 contain a reflected cross-site scripting (XSS) vulnerability in the HtmlErrorRenderer component. When an application passes untrusted or request-derived data into HttpException::setTitle() or HttpException::setDescription(), that data is rendered unescaped on the HTML error page, even with displayErrorDetails set to false. Built-in exceptions such as HttpNotFoundException and HttpBadRequestException use plain-text defaults and are not exploitable; only applications that explicitly feed user-controlled input into these setter methods are affected [1][2].

Exploitation

An attacker requires no special network position beyond being able to trigger an HTTP error response containing the injected payload. The attacker must identify an application endpoint where the error title or description is dynamically constructed from request parameters (e.g., query string, POST body, or headers). No authentication is needed if the error endpoint is public. The attacker crafts a request with malicious HTML/JavaScript embedded in the parameter that flows into setTitle() or setDescription(). When a victim visits the resulting error page, the injected script executes in the context of the application's origin [2].

Impact

Successful exploitation allows an attacker to execute arbitrary HTML and JavaScript in the browser of any user who accesses the generated error page. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The attacker gains no server-side access; the compromise is limited to the client-side session against the affected application's origin [2].

Mitigation

The vulnerability has been fixed in Slim version 4.15.2 [1][2]. Developers unable to upgrade immediately should avoid passing untrusted or request-derived data into HttpException::setTitle() and setDescription(), instead using static, plain-text error copy. Additionally, they can register a custom error renderer (implementing ErrorRendererInterface or subclassing HtmlErrorRenderer with proper escaping) for the text/html media type. No CISA KEV listing has been published as of this writing.