eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error template
This security advisory fixes a vulnerability in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy via the LegacyBridge.
Installations where all modules are disabled may be vulnerable to XSS injection in the module name. This is a rare configuration, but we still recommend installing the update, which adds the necessary input washing.
To install, use Composer to update to one of the "Resolving versions" mentioned above, or apply this patch manually: https://github.com/ezsystems/ezpublish-legacy/commit/4697bff700e8cf95d5847ea19dad3479a77b02d9
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | ezsystems/ezpublish-legacy | >= 2018.9.0, < 2018.9.1.2, >= 2018.6.0, < 2018.6.1.3, >= 2011.0.0, < 2017.12.4.2, >= 5.4.0, < 5.4.12.2, >= 5.3.0, < 5.3.12.5 | 2018.9.1.2, 2018.6.1.3, 2017.12.4.2, 5.4.12.2, 5.3.12.5 |
References
- https://github.com/ezsystems/ezpublish-legacy/commit/4697bff700e8cf95d5847ea19dad3479a77b02d9
- https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2018-11-01-1.yaml
- https://github.com/ezsystems/ezpublish-legacy
- https://web.archive.org/web/20210614172734/http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template
- http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template
- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
ezsystems/ezpublish-legacy- Disclosed
- 15.05.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-2vh3-cj9j-mcj5 - CC BY 4.0
Vulnerability history: ezsystems/ezpublish-legacy
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 11
- First → latest
- 09.2021 05.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 6
- Medium 4
Disclosures per year
- 2021: 1
- 2022: 2
- 2023: 0
- 2024: 7
- 2025: 0
- 2026: 1
-
eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error template this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.