CVE-2026-48157 Slim has Reflected XSS in the HtmlErrorRenderer
Attackers can inject JavaScript via unescaped error titles in Slim framework if developers pass untrusted data to exception setters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-48157?
CVE-2026-48157 is a medium-severity cross-site scripting vulnerability in slimphp Slim, published on 15 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpException::setTitle() and/or setDescription() to include untrusted/request-derived data in the error title or description (e.g. "No products found matching '{$query}'."), an attacker could inject arbitrary HTML/JavaScript that executes in the victim's browser when they encounter an HTML error page generated by Slim. The vulnerability is present even with displayErrorDetails = false as the unescaped title and description are rendered on this error path. Built-in exceptions (HttpNotFoundException, HttpBadRequestException, etc.) ship plain-text defaults, so a vanilla Slim app with no user code is not exploitable. Only applications that feed untrusted data into setTitle() and/or setDescription() are affected. The issue has been fixed in 4.15.2. If developers are unable to immediately update their applications, they can work around this issue by avoiding passing untrusted/request-derived data into HttpException::setTitle() and setDescription() and using static, plain-text error copy instead. They should also register a custom error renderer (an ErrorRendererInterface implementation, or a subclass of HtmlErrorRenderer that escapes the title and description) for the HTML media type.
Weakness: CWE-79
Which versions are affected by CVE-2026-48157?
2 open source packages ship an affected version, including slim/slim.
| Package | Affected | Fixed in |
|---|---|---|
slim/slim Packagist | From 4.4.0 | 4.15.2 |
slim/slim Packagist | From 4.4.0 | 4.15.2 |
How do I fix CVE-2026-48157?
Upgrade slim/slim to 4.15.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-48157 being exploited?
There is no known exploitation of CVE-2026-48157 in the wild and no public exploit code.
Sources
Also known as GHSA-53h4-8rc4-f539.