SlimPHP is a PHP micro framework for web applications and APIs. Versions 4.4.0 through 4.15 have an XSS vulnerability (CWE-79) in the error handling mechanism. If an application uses HttpException::setTitle() or setDescription() with untrusted, request-derived data, an attacker can inject malicious HTML/JavaScript that executes in the victim's browser when an error page is rendered. This occurs even if displayErrorDetails is false, as the title and description are not escaped. Built-in exceptions use safe plain-text defaults, so only applications explicitly passing untrusted data to these methods are affected. The vulnerability is fixed in version 4.15.2. Workarounds include avoiding untrusted data in these methods and registering a custom error renderer that escapes output.

An attacker can execute arbitrary HTML or JavaScript in the context of the victim's browser by injecting malicious content into error titles or descriptions if the application passes untrusted data to HttpException::setTitle() or setDescription(). This can lead to information disclosure or session hijacking. The vulnerability does not affect vanilla Slim applications that do not customize error titles or descriptions with untrusted input. There are no known exploits in the wild as of the published date.

A fix is available in SlimPHP version 4.15.2. Developers should upgrade to this version to fully remediate the vulnerability. If immediate upgrading is not possible, developers should avoid passing untrusted or request-derived data into HttpException::setTitle() and setDescription(), using only static, plain-text error messages. Additionally, registering a custom error renderer that properly escapes the title and description for HTML output is recommended to prevent XSS.