Description
The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | zendframework | 1.12.9+dfsg-2+deb8u3 | DSA-3340-1 |
| Debian 7 | zendframework | 1.11.13-1.1+deb7u3 | DSA-3340-1 |
| Debian 6.0 | zendframework | 1.10.6-1squeeze5 | DLA-302-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP2 | php53 | 5.3.17-47.1 | SUSE-SU-2016:1638-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection EDB-38573 · webapps · Oct 30, 2015
- Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection EDB-37765 · webapps · Aug 13, 2015
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | zendframework/zendframework | >= 2.0.0, < 2.4.6 | 2.4.6 | GHSA-xp8p-9rq5-4wgv |
| Packagist | zendframework/zendframework | >= 2.5.0, < 2.5.2 | 2.5.2 | GHSA-xp8p-9rq5-4wgv |
| Packagist | zendframework/zendframework | >= 1.12.0, < 1.12.14 | 1.12.14 | GHSA-xp8p-9rq5-4wgv |
| Packagist | zendframework/zendframework1 | >= 1.12.0, < 1.12.14 | 1.12.14 | GHSA-xp8p-9rq5-4wgv |
| Packagist | zendframework/zendxml | >= 1.0.0, < 1.0.1 | 1.0.1 | GHSA-xp8p-9rq5-4wgv |
Advisories 3
- DSA-3340-1 zendframework - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-302-1 zendframework - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2016:1638-1 Security update for php53 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://packetstormsecurity.com/files/133068/Zend-Framework-2.4.2-1.12.13-XXE-Injection.html
- FEDORA-2015-13488 vendor-advisory
- http://legalhackers.com/advisories/zend-framework-XXE-vuln.txt
- 76177 vdb-entry
- FEDORA-2015-13529 vendor-advisory
- 37765 exploit
- FEDORA-2015-13314 vendor-advisory
- DSA-3340 vendor-advisory
- http://framework.zend.com/security/advisory/ZF2015-06
- 20150813 Zend Framework <= 2.4.2 XML eXternal Entity Injection (XXE) on PHP FPM mailing-list