{"id":"GHSA-hx3m-959f-v849","aliases":[],"status":"published","title":"ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`","description":"Zend_View is a component that utilizes PHP as a templating language. To utilize it, you specify \"script paths\" that contain view scripts, and then `render()` view scripts by specifying subdirectories within those script paths; the output is then returned as a string value which may be cached or directly output.\n\n`Zend_View::setScriptPath()` in versions up to and including 1.7.4 include a potential Local File Inclusion vulnerability. If untrusted input is used to specify the script path and/or view script itself, a malicious attacker could potentially specify a system directory and thus render a system file.\n\nAs an example, if the user-supplied string `/etc/passwd` or a relative path that resolved to that file, was supplied to `Zend_View::render()`, that file would be rendered.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-06-07T21:07:38Z","modified":"2024-06-07T21:07:39Z","fixes":[{"ecosystem":"Packagist","package":"zendframework/zendframework1","fixed_in":["1.7.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.7.5"}]}]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.7.5"}]}]}],"references":[{"url":"https://framework.zend.com/security/advisory/ZF2009-01","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2009-01.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hx3m-959f-v849"},{"url":"https://github.com/zendframework/zf1","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-hx3m-959f-v849","title":"ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`","description":"Zend_View is a component that utilizes PHP as a templating language. To utilize it, you specify \"script paths\" that contain view scripts, and then `render()` view scripts by specifying subdirectories within those script paths; the output is then returned as a string value which may be cached or directly output.\n\n`Zend_View::setScriptPath()` in versions up to and including 1.7.4 include a potential Local File Inclusion vulnerability. If untrusted input is used to specify the script path and/or view script itself, a malicious attacker could potentially specify a system directory and thus render a system file.\n\nAs an example, if the user-supplied string `/etc/passwd` or a relative path that resolved to that file, was supplied to `Zend_View::render()`, that file would be rendered.","status":"published","published":"2024-06-07T21:07:38Z","modified":"2024-06-07T21:07:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:53.703286Z"}],"osv":[{"id":"GHSA-hx3m-959f-v849","title":"ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`","description":"Zend_View is a component that utilizes PHP as a templating language. To utilize it, you specify \"script paths\" that contain view scripts, and then `render()` view scripts by specifying subdirectories within those script paths; the output is then returned as a string value which may be cached or directly output.\n\n`Zend_View::setScriptPath()` in versions up to and including 1.7.4 include a potential Local File Inclusion vulnerability. If untrusted input is used to specify the script path and/or view script itself, a malicious attacker could potentially specify a system directory and thus render a system file.\n\nAs an example, if the user-supplied string `/etc/passwd` or a relative path that resolved to that file, was supplied to `Zend_View::render()`, that file would be rendered.","status":"published","published":"2024-06-07T21:07:38Z","modified":"2024-06-07T21:07:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:49.621585Z"}]}}