CVE-2026-48157: Slim PHP Framework XSS Vulnerability

CVE-2026-48157 Overview

CVE-2026-48157 is a Cross-Site Scripting (XSS) vulnerability in the Slim PHP micro framework affecting versions 4.4.0 through 4.15. The flaw resides in the default HTML error renderer, which fails to escape values passed to HttpException::setTitle() and HttpException::setDescription(). Applications that feed untrusted or request-derived data into these methods allow attackers to inject arbitrary HTML or JavaScript that executes in the victim's browser when an HTML error page renders. The vulnerability persists even with displayErrorDetails = false. Slim 4.15.2 resolves the issue [CWE-79].

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and client-side action hijacking on affected Slim applications.

Affected Products

Slim Framework versions 4.4.0 through 4.15.1
PHP applications using HttpException::setTitle() with untrusted input
PHP applications using HttpException::setDescription() with untrusted input

Discovery Timeline

2026-06-15 - CVE-2026-48157 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48157

Vulnerability Analysis

The vulnerability arises in Slim's default HtmlErrorRenderer, which composes an HTML error page from the title and description carried by an HttpException. The renderer interpolates these values directly into the HTML response without applying output encoding. When developers populate either field with attacker-controlled data, such as a search query echoed back in a "No products found matching '{$query}'." message, the response includes the raw payload.

A browser receiving the response parses any injected <script> or event-handler markup and executes it under the application's origin. The vulnerable code path runs regardless of the displayErrorDetails setting, so production deployments that disable verbose error output remain exposed. Built-in Slim exceptions like HttpNotFoundException and HttpBadRequestException ship with static, plain-text defaults and are not exploitable on their own.

Root Cause

The root cause is missing output encoding in the HTML error renderer for fields that the framework treats as developer-controlled but that applications frequently populate with request-derived data. The framework does not document the fields as raw HTML sinks, leading developers to feed untrusted input into them.

Attack Vector

An attacker crafts a request whose parameters are reflected by the target application into setTitle() or setDescription() on an HttpException. Delivery typically occurs through a phishing link or a malicious page that triggers the error path. When the victim follows the link, Slim renders the unescaped payload and the browser executes the script in the application's security context.

No verified public proof-of-concept is referenced in the advisory. See the GitHub Security Advisory GHSA-53h4-8rc4-f539 for vendor analysis.

Detection Methods for CVE-2026-48157

Indicators of Compromise

HTTP request parameters containing <script>, onerror=, onload=, or javascript: sequences that subsequently appear in 4xx or 5xx HTML responses.
Web server access logs showing reflected URL or POST parameters within Slim-generated error page bodies.
Outbound browser requests from victims to attacker-controlled domains following navigation to application error URLs.

Detection Strategies

Inventory composer.lock files across PHP projects for slim/slim versions between 4.4.0 and 4.15.1.
Perform static analysis (grep, phpstan, or psalm) for calls to HttpException::setTitle( and HttpException::setDescription( and audit whether arguments derive from $request, $_GET, $_POST, or route attributes.
Run authenticated dynamic application security testing (DAST) scans that submit XSS payloads to endpoints known to throw HttpException with reflected context.

Monitoring Recommendations

Alert on web application firewall (WAF) blocks of script tags reflected in 4xx and 5xx HTML responses originating from PHP backends.
Monitor Content Security Policy (CSP) violation reports for inline script execution on error routes.
Track Slim framework version drift in software composition analysis (SCA) tooling to catch unpatched deployments.

How to Mitigate CVE-2026-48157

Immediate Actions Required

Upgrade slim/slim to version 4.15.2 or later by running composer require slim/slim:^4.15.2 and redeploying affected services.
Audit application code for any path that passes request-derived data to HttpException::setTitle() or HttpException::setDescription() and replace with static error copy.
Deploy a strict Content Security Policy that forbids inline scripts to reduce blast radius on remaining XSS sinks.

Patch Information

The maintainers fixed the issue in Slim 4.15.2. The release escapes title and description values in the default HTML error renderer. Review the GitHub Security Advisory GHSA-53h4-8rc4-f539 for full vendor guidance.

Workarounds

Use only static, plain-text strings as arguments to HttpException::setTitle() and HttpException::setDescription() until upgrade is feasible.
Register a custom ErrorRendererInterface implementation for the text/html media type, or subclass HtmlErrorRenderer to apply htmlspecialchars() to title and description fields.
Restrict error responses to JSON or plain-text content types for API endpoints that do not require HTML error pages.

bash

# Configuration example
composer require slim/slim:^4.15.2
composer update slim/slim