CVE-2015-5161: The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, an...

Security readout for executives and security teams

This flaw affects older ZendXml and Zend Framework versions used by PHP applications. In a PHP-FPM threaded environment, crafted multibyte XML can bypass Zend XML security scanning and enable XXE/XEE attacks. Treat it as urgent for internet-facing or partner-facing apps that parse untrusted XML, but the supplied sources do not show active exploitation. Exposure is likely limited to PHP applications using the affected ZendXml or Zend Framework versions, running PHP-FPM in a threaded environment, and accepting attacker-controlled XML. Applications that do not parse untrusted XML or are already on fixed versions are less likely exposed. Prioritize remediation for externally reachable systems or business integrations that parse XML. This is older software, so the key business risk is latent exposure in legacy PHP services. If no affected Zend components are present, priority can drop after documented validation. Mitigation focus: Upgrade ZendXml to 1.0.1 or later where used.; Upgrade Zend Framework 1 to 1.12.14 or later.; Upgrade Zend Framework 2.x to 2.4.6 or later..

Prepared

Jun 13, 2026, 22:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.