Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

laminas/laminas-view

              3.2.x @ e1eb6e4
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Cross-Site Scripting (XSS): 2 prior fixes. Scrutinize any change in this area.

TemplatePathStack.php: most-fixed (1 issue). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Insecure template path resolution in TemplatePathStack can allow attackers to perform Local File Inclusion (LFI) by traversing directories and including unauthorized files via the include sink.

Cross-Site Scripting (XSS): HTML attribute injection is possible if helpers use standard HTML escaping (escapeHtml) rather than context-specific attribute escaping (escapeHtmlAttr) when rendering properties.

Information Disclosure: Automatic HTTP Accept header negotiation can result in the unintentional serialization of sensitive internal view model variables that should never be exposed to the client.