ZendFramework has potential Cross-site Scripting vector in multiple view helpers
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.
Summary
Many Zend Framework 2 view helpers were using the `escapeHtml()` view helper in order to escape HTML attributes, instead of the more appropriate `escapeHtmlAttr()`. In situations where user data and/or JavaScript is used to seed attributes, this can lead to potential cross site scripting (XSS) attack vectors. Vulnerable view helpers include: - All `Zend\Form` view helpers. - Most `Zend\Navigation` (aka `Zend\View\Helper\Navigation\*`) view helpers. - All "HTML Element" view helpers: `htmlFlash()`, `htmlPage()`, `htmlQuickTime()`. - `Zend\View\Helper\Gravatar`
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | zendframework/zend-view (Packagist) | 2.0.0 to before 2.2.7 | 2.2.7 | Patch available | GHSA-m7hr-j867-3f34 |
| — | zendframework/zend-view (Packagist) | 2.3.0 to before 2.3.1 | 2.3.1 | Patch available | GHSA-m7hr-j867-3f34 |
- zendframework/zend-view (Packagist) Vendor— Affected 2.0.0 to before 2.2.7 Fixed in 2.2.7 Patch available GHSA-m7hr-j867-3f34
- zendframework/zend-view (Packagist) Vendor— Affected 2.3.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-m7hr-j867-3f34
Remediation
- Fix · GHSA-m7hr-j867-3f34 zendframework/zend-view (Packagist) Fixed in 2.2.7 Advisory →
- Fix · GHSA-m7hr-j867-3f34 zendframework/zend-view (Packagist) Fixed in 2.3.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-m7hr-j867-3f34
References
Other 7
- https://github.com/zendframework/zendframework/commit/12f89b587cd23dd781cde25c9dd2da75d8f829d7
- https://github.com/zendframework/zendframework/commit/1dd4f8cede07469390eef1e629f808349fa1b5ea
- https://github.com/zendframework/zendframework/commit/6742ddad7a7923163cea6dd58d27d0e946a402d1
- https://github.com/zendframework/zendframework/commit/ec6c0468514c111a244552cfb7cf575a726e017e
- https://framework.zend.com/security/advisory/ZF2014-03
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-view/ZF2014-03.yaml
- https://github.com/zendframework/zend-view
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences