GHSA-hmr5-2xcr-v8pp
Suggest an improvement- Source
- https://github.com/advisories/GHSA-hmr5-2xcr-v8pp
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-hmr5-2xcr-v8pp/GHSA-hmr5-2xcr-v8pp.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-hmr5-2xcr-v8pp
- Aliases
- Published
- 2026-05-27T21:10:44Z
- Modified
- 2026-09-10T03:51:06Z
- Severity
-
- 1.2 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U CVSS Calculator
- Summary
- Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
- Details
-
Description
Symfony's profiler, a development only debug UI, renders source-code excerpts on several pages using Twig's custom
file_excerptfilter. This filter renders PHP files viahighlight_string()(which escapes HTML), but renders non-PHP files by splitting on\nand interpolating each line directly into<code>{$line}</code>with no escaping.An attacker who can write arbitrary bytes into any file under the project root (including e.g.
var/log/dev.log), achieves stored XSS against any developer who later opens that file in the profiler.Resolution
The
file_excerptfilter now properly escapes each line of non-PHP files usinghtmlspecialchars()before concatenating them.The patch for this issue is available here for branch 6.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Database specific
{ "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2026-05-27T21:10:44Z", "nvd_published_at": null, "severity": "LOW" }- References
-
- https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp
- https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45072.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/twig-bridge/CVE-2026-45072.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/web-profiler-bundle/CVE-2026-45072.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45072
Affected packages
Packagist
symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony/symfony
symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony/symfony
symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony/symfony
symfony/twig-bridge
Package
- Name
- symfony/twig-bridge
- Purl
- pkg:composer/symfony/twig-bridge
symfony/web-profiler-bundle
Package
- Name
- symfony/web-profiler-bundle
- Purl
- pkg:composer/symfony/web-profiler-bundle
symfony/web-profiler-bundle
Package
- Name
- symfony/web-profiler-bundle
- Purl
- pkg:composer/symfony/web-profiler-bundle