CVE-2026-42224
ipl/web is vulnerable to reflected XSS by malformed search requests
ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
ipl/web is vulnerable to reflected XSS by malformed search requests
ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.
- Record
CVE-2026-42224- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-28847
ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.
- Record
EUVD-2026-28847- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-55wf-5m3q-6jjf
ipl/web is vulnerable to reflected XSS by malformed search requests
Impact
The vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing.
Patches
Version 0.13.1 includes a fix for this. It will be published as part of icinga-php-library version 0.19.2.
Workarounds
Enable the Content-Security-Policy (CSP) in the general configuration of Icinga Web available since version 2.12.0.
References
None
- Record
GHSA-55wf-5m3q-6jjf- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.
- Record
CVE-2026-42224- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
ipl/web is vulnerable to reflected XSS by malformed search requests
ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.
- Record
CVE-2026-42224- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-04
OSVGHSA-55wf-5m3q-6jjf
ipl/web is vulnerable to reflected XSS by malformed search requests
Impact
The vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing.
Patches
Version 0.13.1 includes a fix for this. It will be published as part of icinga-php-library version 0.19.2.
Workarounds
Enable the Content-Security-Policy (CSP) in the general configuration of Icinga Web available since version 2.12.0.
References
None
- Record
GHSA-55wf-5m3q-6jjf- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10693-1 No score
icinga-php-library-0.19.2-1.1 on GA media
These are all security issues fixed in the icinga-php-library-0.19.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10693-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ipl/webPackagist |
0.11.0 to 0.13.0 | 0.13.1 |
ipl/webPackagist |
through 0.10.2 | 0.10.3 |
ipl/webPackagist |
0.11.0 up to 0.13.1, plus listed versions v0.11.1v0.12.0v0.13.0 |
0.13.1 |
ipl/webPackagist |
before 0.10.3, plus listed versions v0.1.0v0.10.0v0.10.1v0.10.2v0.2.0 Show 11 moreShow lessv0.2.1v0.3.0v0.4.0v0.5.0v0.6.0v0.7.0v0.7.1v0.8.0v0.9.0v0.9.1v0.9.2 |
0.10.3 |
icinga-php-libraryopenSUSE:Tumbleweed |
before 0.19.2-1.1 | 0.19.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-42224 is a high vulnerability (CVSS 7.6) in Icinga Ipl-web, published April 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in ipl/web 0.13.1.
References
github.com/Icinga/ipl-web/security/advisories/GHSA-55wf-5m3q-6jjf
nvd.nist.gov/vuln/detail/CVE-2026-42224
suse.com/security/cve/CVE-2026-42224