ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`GHSA-hx3m-959f-v849
HIGHGHSA-hx3m-959f-v849 is a high-severity (CVSS 7.5) vulnerability in zendframework/zendframework1. A fix is available for zendframework/zendframework1 — see the affected versions and patch details below.
Real-World Exposure
zendframework/zendframework1Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Zend_View is a component that utilizes PHP as a templating language. To utilize it, you specify "script paths" that contain view scripts, and then render() view scripts by specifying subdirectories within those script paths; the output is then returned as a string value which may be cached or directly output.
Zend_View::setScriptPath() in versions up to and including 1.7.4 include a potential Local File Inclusion vulnerability. If untrusted input is used to specify the script path and/or view script itself, a malicious attacker could potentially specify a system directory and thus render a system file.
As an example, if the user-supplied string /etc/passwd or a relative path that resolved to that file, was supplied to Zend_View::render(), that file would be rendered.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | zendframework/zendframework1 | ≥ 1.7.0&&< 1.7.5 | 1.7.5composer require zendframework/zendframework1:^1.7.5 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for zendframework/zendframework1, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update zendframework/zendframework1 to 1.7.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hx3m-959f-v849 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is GHSA-hx3m-959f-v849 in your dependencies?
Find it across Packagist, including transitive dependencies.