{"items":[{"id":"NVI-00005031","kind":"vulnerability","title":"ZendFramework Route Parameter Injection Via Query String in `Zend\\Mvc`","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jq87-2wxp-8349"],"plain_summary":"OSV carries this publisher advisory for zendframework/zendframework, zendframework/zendframework. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.0.8 for zendframework/zendframework. Confirm the publisher’s latest guidance.","source_ids":["sr-7e34758585ed212a1c4999e81995da05"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.1.4 for zendframework/zendframework. Confirm the publisher’s latest guidance.","source_ids":["sr-7e34758585ed212a1c4999e81995da05"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-7e34758585ed212a1c4999e81995da05","url":"https://github.com/advisories/GHSA-jq87-2wxp-8349","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-jq87-2wxp-8349","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.968Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-7e34758585ed212a1c4999e81995da05"],"technology":"zendframework/zendframework","known_exclusions":[],"conditions_summary":"In Zend Framework 2, `Zend\\Mvc\\Router\\Http\\Query` is used primarily to allow appending query strings to URLs when assembled. However, due to the fact that it captures any query parameters into the RouteMatch, and the fact that RouteMatch parameters are merged with any parent routes, this can lead to overriding already captured routing parameters, bypassing constraints defined in the parents.\n\nAs an example, consider the following route definition:\n```\narray(\n    'user' => array(\n        'type' => 'segment',\n        'options' => array(\n            'route' => '/user/:key',\n            'defaults' => array(\n                'controller' => 'UserController',\n                'action'     => 'show-action',\n            ),\n            'constraints' => array(\n                'key' => '[a-z0-9]+',\n            ),\n        ),\n        'child_routes' => array(\n            'query' => array('type' => 'query'),\n        ),\n    ),\n)\n```\nIf the request URI was /user/foo/?controller=SecretController&key=invalid_value, the RouteMatch returned after routing would contain the following:\n```\narray(\n    'controller' => 'SecretController',\n    'action'     => 'show-action',\n    'key'        => 'invalid_value',\n","public_affected_ranges":["ECOSYSTEM: introduced 2.0.0; fixed 2.0.8"]},{"certainty":"source_listed","source_ids":["sr-7e34758585ed212a1c4999e81995da05"],"technology":"zendframework/zendframework","known_exclusions":[],"conditions_summary":"In Zend Framework 2, `Zend\\Mvc\\Router\\Http\\Query` is used primarily to allow appending query strings to URLs when assembled. However, due to the fact that it captures any query parameters into the RouteMatch, and the fact that RouteMatch parameters are merged with any parent routes, this can lead to overriding already captured routing parameters, bypassing constraints defined in the parents.\n\nAs an example, consider the following route definition:\n```\narray(\n    'user' => array(\n        'type' => 'segment',\n        'options' => array(\n            'route' => '/user/:key',\n            'defaults' => array(\n                'controller' => 'UserController',\n                'action'     => 'show-action',\n            ),\n            'constraints' => array(\n                'key' => '[a-z0-9]+',\n            ),\n        ),\n        'child_routes' => array(\n            'query' => array('type' => 'query'),\n        ),\n    ),\n)\n```\nIf the request URI was /user/foo/?controller=SecretController&key=invalid_value, the RouteMatch returned after routing would contain the following:\n```\narray(\n    'controller' => 'SecretController',\n    'action'     => 'show-action',\n    'key'        => 'invalid_value',\n","public_affected_ranges":["ECOSYSTEM: introduced 2.1.0; fixed 2.1.4"]}],"null_published_at":"2026-10-31T22:12:57.152Z","source_updated_at":"2024-12-04T05:39:51.381Z","source_disclosed_at":"2024-06-07T20:15:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:30.968Z"}],"next_cursor":null,"snapshot_revision":"42594"}