-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zendframework/zendframework1 | composer | < 1.11.15 | 1.11.15 |
| zendframework/zendframework1 | composer | >= 1.12.0-rc1, < 1.12.1 | 1.12.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure XML parsing in Zend_Feed components. The commit patches show that both Zend_Feed::importString and Zend_Feed_Abstract's constructor were modified to add libxml_disable_entity_loader protections. Prior to the fix, these functions parsed XML (via DOMDocument::loadXML) without disabling external entity resolution, allowing attackers to inject malicious entities. The vulnerable code paths are directly in the XML processing methods before entity loader hardening was implemented.