GitHub Advisoryadvisory · Packagist

GHSA-55wf-5m3q-6jjf ipl/web is vulnerable to reflected XSS by malformed search requests

HIGH Published 2026-04-29 Modified 2026-06-09 Official page ↗
Aliases
CVE-2026-42224
Ecosystem
Packagist
Packages
ipl/web
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2026-04-29

Affected packages

• Packagist ipl/web: >= 0.11.0, < 0.13.1 → fixed in 0.13.1 • Packagist ipl/web: < 0.10.3 → fixed in 0.10.3

Description

Impact The vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. Patches Version 0.13.1 includes a fix for this. It will be published as part of `icinga-php-library` version 0.19.2. Workarounds Enable the Content-Security-Policy (CSP) in the general configuration of Icinga Web available since version 2.12.0. References None

Related

Alias · CVE (1)

  • CVE-2026-42224 ipl/web is a set of common web components for php projects. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References