CVE-2015-3257: Zend Diactoros

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting (XSS) or open redirect attacks.

Affected products

• Zend Diactoros: up to and including 1.0.3

Published 2017-08-25. Last modified 2026-06-17.