Description
Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting (XSS) or open redirect attacks.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | zendframework/zend-diactoros | >= 1.0.0, < 1.0.4 | 1.0.4 | GHSA-rh3c-7wqx-6w95 |