-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zendframework/zendframework1 | composer | >= 1.0, < 1.11.13 | 1.11.13 |
| zendframework/zendframework1 | composer | >= 1.12.0-rc1, < 1.12.0 | 1.12.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure XML parsing patterns in multiple components. The commit diff shows critical security patches: 1) Adding libxml_disable_entity_loader(true) before XML processing, 2) Explicit checks for XML_DOCUMENT_TYPE_NODE in DOM children, and 3) Replacement of SimpleXMLElement with DOMDocument+validation. The vulnerable functions are those that processed XML without these protections. Each listed function handled external XML input using unsafe methods prior to the patch, as evidenced by the security fixes adding entity loader disabling and DOCTYPE validation.
PHPPHPOngoing coverage of React2Shell