PT-2026-44141 · Symfony · Symfony

Published 2026-05-21 · Updated 2026-05-27 · CVE-2026-45072

Positive Technologies (AI Summary)

CVSS v4.0

1.2

Low

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Symfony (affected versions not specified)

Description The profiler, a debug UI used only during development, renders source-code excerpts using the file excerpt filter. While PHP files are rendered via highlight string() to escape HTML, non-PHP files are processed by splitting content on and interpolating lines directly into <code> tags without escaping. This allows an attacker who can write arbitrary bytes into any file under the project root, such as var/log/dev.log, to achieve stored Cross-Site Scripting (XSS) against developers who view that file in the profiler.

Recommendations Update to the version containing the patch for branch 6.4, which ensures the file excerpt filter uses htmlspecialchars() to escape lines of non-PHP files.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-45072

GHSA-HMR5-2XCR-V8PP

Affected Products

Symfony

References · 14

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/twig-bridge/CVE-2026-45072.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45072.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/web-profiler-bundle/CVE-2026-45072.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-hmr5-2xcr-v8pp · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45072 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45072 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45072 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-45072 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45072 · Vendor Advisory
• https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb · Note
• https://github.com/symfony/symfony · Note
• https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp · Note
• https://symfony.com/blog/cve-2026-45072-stored-xss-in-webprofiler-codeextension-fileexcerpt-unescaped-non-php-file-rendering · Note
• https://symfony.com/cve-2026-45072 · Note