Zend-Form vulnerable to Cross-site Scripting
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.
Summary
Many Zend Framework 2 view helpers were using the escapeHtml() view helper in order to escape HTML attributes, instead of the more appropriate escapeHtmlAttr(). In situations where user data and/or JavaScript is used to seed attributes, this can lead to potential cross site scripting (XSS) attack vectors. Vulnerable view helpers include: - All `Zend\Form` view helpers. - Most `Zend\Navigation` (aka `Zend\View\Helper\Navigation\*`) view helpers. - All "HTML Element" view helpers: `htmlFlash()`, `htmlPage()`, `htmlQuickTime()`. - `Zend\View\Helper\Gravatar`
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | zendframework/zend-form (Packagist) | 2.0.0 to before 2.2.7 | 2.2.7 | Patch available | GHSA-gvpp-6jrj-5pqc |
| — | zendframework/zend-form (Packagist) | 2.3.0 to before 2.3.1 | 2.3.1 | Patch available | GHSA-gvpp-6jrj-5pqc |
- zendframework/zend-form (Packagist) Vendor— Affected 2.0.0 to before 2.2.7 Fixed in 2.2.7 Patch available GHSA-gvpp-6jrj-5pqc
- zendframework/zend-form (Packagist) Vendor— Affected 2.3.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-gvpp-6jrj-5pqc
Remediation
- Fix · GHSA-gvpp-6jrj-5pqc zendframework/zend-form (Packagist) Fixed in 2.2.7 Advisory →
- Fix · GHSA-gvpp-6jrj-5pqc zendframework/zend-form (Packagist) Fixed in 2.3.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-gvpp-6jrj-5pqc
References
Other 6
- https://github.com/zendframework/zend-form/commit/6fe40314e8e3477494aadd03d62573bd1c212bd1
- https://github.com/zendframework/zend-form/commit/d7a1f5bc4626b1df990391502a868b28c37ba65d
- https://github.com/zendframework/zend-form/commit/fd43a951460c4bc60c77a566129705f6bdb9c61b
- https://framework.zend.com/security/advisory/ZF2014-03
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-form/ZF2014-03.yaml
- https://github.com/zendframework/zend-form
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences