CVE-2026-48157

Name of the Vulnerable Software and Affected Versions Slim versions 4.4.0 through 4.15

Description Reflected Cross-Site Scripting (XSS) occurs in the HtmlErrorRenderer when an application uses the setTitle() and/or setDescription() functions of HttpException to include untrusted or request-derived data in error titles or descriptions. This allows an attacker to inject arbitrary HTML or JavaScript that executes in the victim's browser upon encountering a Slim-generated HTML error page. The issue persists even when displayErrorDetails is set to false. Only applications that pass untrusted data into these functions are affected, as built-in exceptions use plain-text defaults.

Recommendations Update to version 4.15.2. Avoid passing untrusted or request-derived data into HttpException::setTitle() and HttpException::setDescription(), using static, plain-text error copy instead. Register a custom error renderer, such as an ErrorRendererInterface implementation or a subclass of HtmlErrorRenderer that escapes the title and description for the HTML media type.