CVE-2026-48157: Slim Framework XSS Vulnerability in HttpException (v4.4.0-4.15)

Technical summary

CVE-2026-48157 is a stored XSS vulnerability in Slim framework's HttpException class. When applications call setTitle() or setDescription() with untrusted input, the framework renders these values directly into HTML error pages without proper escaping. The vulnerability manifests in the error rendering path used by Slim's error handler middleware, affecting both normal and minimal error display modes. The root cause is the absence of output encoding in the HtmlErrorRenderer component when constructing error page markup from exception metadata. Built-in exception subclasses (HttpNotFoundException, HttpBadRequestException) are not vulnerable because they use static, predefined messages. Custom applications that interpolate request parameters or external data into exception titles or descriptions create an exploitable code path. Patch version 4.15.2 introduces proper HTML entity encoding for these fields.

Business impact

For organizations running Slim-based applications, the risk depends entirely on whether development teams have passed user-controlled data into exception messages. Vulnerable applications could suffer credential theft, session hijacking, malware distribution, or account takeover if error pages are accessible to end users. Since the vulnerability requires developer-level misuse rather than a framework-level defect that affects all deployments, the business impact is moderate but potentially severe for affected instances. Attackers could harvest sensitive information displayed in error context or perform client-side attacks against users encountering error pages. Organizations must audit their codebase to identify where HttpException messages are constructed from request data.

Affected systems

Slim framework versions 4.4.0 through 4.15 are vulnerable. Version 4.15.2 and later contain the fix. Applications using earlier major versions (3.x, 2.x) or versions 4.0 through 4.3 are unaffected. The vulnerability only manifests in applications where developers have explicitly passed untrusted data into setTitle() or setDescription() methods on HttpException or its subclasses. Vanilla Slim installations with default error handling are not exploitable because built-in exceptions use static text.

Exploitability

The vulnerability requires user interaction (a victim must view an error page) and network access to the application. An attacker crafts a request designed to trigger an error condition while injecting HTML/JavaScript into a parameter that the application passes to an exception title or description. The payload executes in the victim's browser context, allowing session stealing, credential harvesting, or malware delivery. The barrier to exploitation is low—standard XSS attack techniques apply. However, exploitability is contingent on the application author having made the specific mistake of feeding request data into exception messages, which is not a default Slim behavior. This is classified as MEDIUM severity (CVSS 6.1) due to the user interaction requirement and limited attack surface, but individual vulnerable applications face significant risk.

Remediation

Organizations should upgrade Slim to version 4.15.2 or later immediately. Before upgrading, developers must audit their codebase for calls to HttpException::setTitle() and setDescription() that incorporate request parameters, environment variables, or other untrusted data. As a temporary mitigation, remove or sanitize any untrusted data passed to these methods, using static error messages instead. Developers can also implement a custom error renderer that properly escapes HTML entities in exception titles and descriptions, or extend HtmlErrorRenderer with proper output encoding. After patching, verify that custom error handling logic does not reintroduce the vulnerability.

Patch guidance

Upgrade Slim to version 4.15.2 or later. Review your composer.json or package manager configuration and apply the update in a staging environment first. Slim follows semantic versioning; 4.15.2 is a patch release and should be backward compatible with 4.15 and earlier 4.x versions. After updating, run your application's test suite to confirm no regressions. If you maintain a custom error renderer or have overridden default error handling, verify that your implementation properly escapes exception metadata before rendering. Consider adding a security test case that confirms injection attempts in exception messages do not execute.

Detection guidance

Monitor application logs for HTTP error page requests that contain suspicious characters (angle brackets, script tags, event handlers) in request parameters. Web application firewalls can detect classic XSS payloads in query strings and POST bodies. Perform static code analysis to identify calls to setTitle() and setDescription() on HttpException objects; flag any invocations where the argument is derived from request input, superglobals, or external sources rather than hardcoded strings. Review error page HTML source (using browser developer tools) to confirm that exception titles and descriptions are properly HTML-entity encoded. Penetr testing should include submitting XSS payloads to parameters known to trigger application errors.

Why prioritize this

Although this vulnerability is rated MEDIUM severity, organizations running affected Slim versions should prioritize patching because: (1) the fix is straightforward and low-risk, (2) many development teams inadvertently pass user data into error messages without realizing the security implication, (3) error pages are often visible to unauthenticated attackers, and (4) XSS vulnerabilities enable a broad range of follow-on attacks. Prioritize any internal or customer-facing applications using Slim 4.4.0–4.15 that have user-generated content or dynamic error messages.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects: (1) network attack vector (AV:N) — no special access required, (2) low attack complexity (AC:L) — standard XSS techniques suffice, (3) no privilege required (PR:N), (4) user interaction required (UI:R) — victim must view an error page, (5) scope change (S:C) — JavaScript can affect user's browser beyond the vulnerable application, and (6) low confidentiality and integrity impact (C:L/I:L) — session theft or defacement, no system-level compromise, no availability impact (A:N). The score appropriately penalizes the user interaction requirement while acknowledging the real client-side risk.

Frequently asked questions