Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
Description
Symfony's profiler, a development only debug UI, renders source-code excerpts on several pages using Twig's custom file_excerpt filter. This filter renders PHP files via highlight_string() (which escapes HTML), but renders non-PHP files by splitting on \n and interpolating each line directly into <code>{$line}</code> with no escaping.
An attacker who can write arbitrary bytes into any file under the project root (including e.g. var/log/dev.log), achieves stored XSS against any developer who later opens that file in the profiler.
Resolution
The file_excerpt filter now properly escapes each line of non-PHP files using htmlspecialchars() before concatenating them.
The patch for this issue is available here for branch 6.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | symfony/symfony | >= 6.4.24, < 6.4.40, >= 7.2.9, < 7.4.12, >= 8.0.0, < 8.0.12 | 6.4.40, 7.4.12, 8.0.12 |
| Composer package | symfony/twig-bridge | >= 6.4.24, < 6.4.40 | 6.4.40 |
| Composer package | symfony/web-profiler-bundle | >= 7.2.9, < 7.4.12, >= 8.0.0, < 8.0.12 | 7.4.12, 8.0.12 |
References
- https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp
- https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45072.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/twig-bridge/CVE-2026-45072.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/web-profiler-bundle/CVE-2026-45072.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45072
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
symfony/symfony, symfony/twig-bridge, symfony/web-profiler-bundle- Disclosed
- 27.05.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-hmr5-2xcr-v8pp - CC BY 4.0
Vulnerability history: symfony/twig-bridge
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 11.2023 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 1
- Low 1
Disclosures per year
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 1
-
Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.