CVE-2026-45072
Severity CVSS v4.0:
LOW
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
14/07/2026
Last modified:
16/07/2026
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler file_excerpt Twig filter escapes PHP files through highlight_string() but interpolates lines from non-PHP files directly into elements, allowing stored XSS against a developer who opens an attacker-written file such as var/log/dev.log in the profiler. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Impact
Base Score 4.0
2.00
Severity 4.0
LOW
Base Score 3.x
5.40
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* | 6.4.24 (including) | 6.4.40 (excluding) |
| cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* | 7.2.9 (including) | 7.4.12 (excluding) |
| cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* | 8.0.0 (including) | 8.0.12 (excluding) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb
- https://github.com/symfony/symfony/releases/tag/v6.4.40
- https://github.com/symfony/symfony/releases/tag/v7.4.12
- https://github.com/symfony/symfony/releases/tag/v8.0.12
- https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp