The vulnerability is an XML External Entity injection that arises when Symfony's Config component allows DTD validation before rejecting a doctype. A remote attacker who can supply XML to XmlUtils::parse can cause the parser to resolve file:// entities, revealing the existence of local files, generating a denial of service by referencing large or slow files, and in some configurations exfiltrating file contents to an external server when a network‑capable stream wrapper is registered.

Symfony applications built with Sensiolabs Symfony before version 5.4.56, 6.x before 6.4.50, 7.x before 7.4.23, and 8.x before 8.1.11 are affected. Any component that uses XmlUtils::parse for configuration, developer input, or translation files (XLIFF) can be vulnerable if it receives untrusted XML.

The CVSS score is 2.3, indicating low severity, and no EPSS score is available, suggesting limited evidence of exploitation. The vulnerability is not listed in CISA's KEV database. Exploitation requires controlling or injecting XML into the parse method, which is typically a remote or local attack surface depending on how the application handles input. Because the vulnerability does not return file contents directly, the primary risk is information disclosure about file existence and potential DoS; however, if a stream wrapper such as s3:// is registered, an attacker could exfiltrate file content. Overall risk is low but could be higher in environments where untrusted XML is processed.