Medium severity5.4OSV Advisory· Published Jul 14, 2026· Updated Jul 16, 2026
CVE-2026-45072
CVE-2026-45072
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler file_excerpt Twig filter escapes PHP files through highlight_string() but interpolates lines from non-PHP files directly into elements, allowing stored XSS against a developer who opens an attacker-written file such as var/log/dev.log in the profiler. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
symfony/symfonyPackagist | >= 6.4.24, < 6.4.40 | 6.4.40 |
symfony/symfonyPackagist | >= 7.2.9, < 7.4.12 | 7.4.12 |
symfony/symfonyPackagist | >= 8.0.0, < 8.0.12 | 8.0.12 |
symfony/twig-bridgePackagist | >= 6.4.24, < 6.4.40 | 6.4.40 |
symfony/web-profiler-bundlePackagist | >= 7.2.9, < 7.4.12 | 7.4.12 |
symfony/web-profiler-bundlePackagist | >= 8.0.0, < 8.0.12 | 8.0.12 |
Affected products
3v8.0.11, v7.4.11, v6.4.39, …+ 2 more
- (no CPE)range: v8.0.11, v7.4.11, v6.4.39, …
- (no CPE)range: 6.4.24 - 6.4.39, 7.4.12 - 7.4.11, 8.0.12 - 8.0.11
- cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*range: >=6.4.24,<6.4.40
Patches
Vulnerability mechanics
References
10- github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdbnvdPatchWEB
- github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8ppnvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-hmr5-2xcr-v8ppghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45072.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/twig-bridge/CVE-2026-45072.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/web-profiler-bundle/CVE-2026-45072.yamlghsaWEB
- github.com/symfony/symfony/releases/tag/v6.4.40nvdRelease Notes
- github.com/symfony/symfony/releases/tag/v7.4.12nvdRelease Notes
- github.com/symfony/symfony/releases/tag/v8.0.12nvdRelease Notes
- symfony.com/cve-2026-45072ghsaWEB
News mentions
0No linked articles in our index yet.