~ / search / GHSA-55wf-5m3q-6jjf

GHSA-55wf-5m3q-6jjf

ipl/web is vulnerable to reflected XSS by malformed search requests

Source: GitHub Advisory Database (reviewed) High CVE-2026-42224

Packages

EcosystemPackageAffectedFixed in
Packagist ipl/web >= 0.11.0, < 0.13.1 0.13.1
Packagist ipl/web < 0.10.3 0.10.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. ### Patches Version 0.13.1 includes a fix for this. It will be published as part of `icinga-php-library` version 0.19.2. ### Workarounds Enable the Content-Security-Policy (CSP) in the general configuration of Icinga Web available since version 2.12.0. ### References None

References

External links from the advisory. They lead to third-party sites.