URL Rewrite vulnerability in multiple zendframework components
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
zend-diactoros (and, by extension, Expressive), zend-http (and, by extension, Zend Framework MVC projects), and zend-feed (specifically, its PubSubHubbub sub-component) each contain a potential URL rewrite exploit. In each case, marshaling a request URI includes logic that introspects HTTP request headers that are specific to a given server-side URL rewrite mechanism. When these headers are present on systems not running the specific URL rewriting mechanism, the logic would still trigger, allowing a malicious client or proxy to emulate the headers to request arbitrary content.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | zendframework/zend-diactoros (Packagist) | before 1.8.4 | 1.8.4 | Patch available | GHSA-f6p5-76fp-m248 |
| — | zendframework/zend-feed (Packagist) | before 2.10.3 | 2.10.3 | Patch available | GHSA-f6p5-76fp-m248 |
| — | zendframework/zend-http (Packagist) | before 2.8.1 | 2.8.1 | Patch available | GHSA-f6p5-76fp-m248 |
- zendframework/zend-diactoros (Packagist) Vendor— Affected before 1.8.4 Fixed in 1.8.4 Patch available GHSA-f6p5-76fp-m248
- zendframework/zend-feed (Packagist) Vendor— Affected before 2.10.3 Fixed in 2.10.3 Patch available GHSA-f6p5-76fp-m248
- zendframework/zend-http (Packagist) Vendor— Affected before 2.8.1 Fixed in 2.8.1 Patch available GHSA-f6p5-76fp-m248
Remediation
- Fix · GHSA-f6p5-76fp-m248 zendframework/zend-diactoros (Packagist) Fixed in 1.8.4 Advisory →
- Fix · GHSA-f6p5-76fp-m248 zendframework/zend-feed (Packagist) Fixed in 2.10.3 Advisory →
- Fix · GHSA-f6p5-76fp-m248 zendframework/zend-http (Packagist) Fixed in 2.8.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-f6p5-76fp-m248
References
Other 3
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-diactoros/ZF2018-01.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-feed/ZF2018-01.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-http/ZF2018-01.yaml
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences