HTML/JavaScript Injection Vulnerability in Slim PHP Micro Framework
CVE-2026-48157

6.1MEDIUM

Key Information:

Vendor

SlimPHP

Status
Slim
Vendor
CVE Published:
15 June 2026

What is CVE-2026-48157?

The Slim PHP micro framework, specifically versions 4.4.0 through 4.15, has a vulnerability that allows attackers to inject arbitrary HTML or JavaScript into error messages. This occurs when applications use HttpException::setTitle() or setDescription() with untrusted or request-derived data, leading to potential exploitation when users view generated HTML error pages. This flaw exists regardless of the displayErrorDetails setting being turned off. Affected applications should avoid using dynamic, untrusted inputs in these methods. Developers are advised to upgrade to version 4.15.2 or later, or implement custom error handling to mitigate this susceptibility by using static, plain-text messages.

Affected Version(s)

Slim >= 4.4.0, < 4.15.2

References

https://github.com/slimphp/Slim/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/slimphp/Slim/releases/tag/4.15.2
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.