-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zendframework/zendframework1 | composer | >= 1.0, < 1.11.13 | 1.11.13 |
| zendframework/zendframework1 | composer | >= 1.12.0-rc1, < 1.12.0 | 1.12.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from XML parsing functions that did not properly restrict DTDs or disable entity loading. The commit patches show these functions were modified to add libxml_disable_entity_loader(true) and explicit checks for XML_DOCUMENT_TYPE_NODE (DOCTYPE declarations). Before the patch, these functions used DOMDocument::loadXML/loadHTML or SimpleXMLElement without these safeguards, making them vulnerable to XEE attacks via recursive/circular entity references. The affected components (Zend_Dom, Zend_Feed, Zend_Soap, Zend_XmlRpc) all had their XML processing functions updated, confirming the vulnerable entry points.
PHPPHPOngoing coverage of React2Shell