Executive brief
Slim is a popular PHP micro-framework used to build web applications and APIs. A vulnerability in its error handling component allows attackers to inject malicious scripts into error pages if the application includes user-provided data in error messages. If exploited, this could allow an attacker to execute unauthorized actions in a user's browser or steal sensitive session information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Slim's `HtmlErrorRenderer`. The root cause is the failure to properly escape data passed to `HttpException::setTitle()` and `HttpException::setDescription()` before rendering it in an HTML error page. An attacker can exploit this by crafting a request that triggers an exception containing malicious HTML or JavaScript. While built-in exceptions use safe defaults, any application logic that reflects request-derived data (e.g., a search query) into these exception methods is vulnerable. The issue persists even if `displayErrorDetails` is disabled. The vulnerability is fixed in version 4.15.2.
Affected products
- Slim Framework Slim >= 4.4.0, <= 4.15.1
Timeline
- 2026-05-22: disclosed
- 2026-06-15: advisory: NVD publication date
- 2026-06-23: patched: GitHub Advisory updated/published