PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48157 slimphp CVE debrief

CVE-2026-48157 is a Medium-severity vulnerability (CVSS Score: 6.1) affecting the Slim PHP micro framework, specifically versions 4.4.0 through 4.15. An attacker can inject arbitrary HTML/JavaScript into error pages generated by Slim if an application uses HttpException::setTitle() and/or setDescription() with untrusted/request-derived data. This issue is present even when displayErrorDetails is set to false. The vulnerability has been fixed in version 4.15.2.

Vendor
slimphp
Product
Slim
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-16
Advisory published
2026-06-15
Advisory updated
2026-06-16

Who should care

Developers using Slim PHP micro framework versions 4.4.0 through 4.15 in their applications, especially those that handle user input and display error pages.

Technical summary

The Slim PHP micro framework is vulnerable to arbitrary HTML/JavaScript injection in error pages. This occurs when HttpException::setTitle() and/or setDescription() are used with untrusted/request-derived data. The issue is present in versions 4.4.0 through 4.15 and has been fixed in version 4.15.2. To mitigate, developers should avoid passing untrusted data into these methods and use static, plain-text error messages instead. A custom error renderer that escapes title and description can also be implemented.

Defensive priority

High

Recommended defensive actions

  • Update Slim PHP micro framework to version 4.15.2 or later.
  • Avoid passing untrusted/request-derived data into HttpException::setTitle() and setDescription().
  • Use static, plain-text error messages.
  • Implement a custom error renderer that escapes title and description.

Evidence notes

CVE-2026-48157 is a confirmed vulnerability in the Slim PHP micro framework. The issue allows for arbitrary HTML/JavaScript injection in error pages, potentially leading to XSS attacks. The vulnerability has been fixed in version 4.15.2.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48157 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48157

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48157 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48157

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.