Symfony is a PHP framework and set of reusable PHP components for web and console applications. Before versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the DomCrawler::addXmlContent() method set DOMDocument::$validateOnParse to true before loading XML. This re‑enabled external entity resolution, allowing attacker‑supplied XML to expand file:// entities and read local files accessible to the PHP process. The vulnerability permits disclosure of any locally available files that the web server process can read, but does not allow code execution, representing a confidentiality violation (CWE‑611).

This issue affects the symfony:dom-crawler and symfony:symfony packages in versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12. Users deploying these older releases of Symfony or its DomCrawler component are potentially impacted, including web applications, console scripts, and services that parse XML via addXmlContent() with untrusted data.

The CVSS score of 8.7 categorizes this flaw as high severity. EPSS indicates the likelihood of exploitation is very low (<1%), and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread targeted attacks have not yet been observed. The most common attack vector would be through a web or console interface that accepts XML input and passes it to addXmlContent() without further validation—especially if the application permits user‑supplied XML to be processed. An attacker could read files such as /etc/passwd or any file readable by the web server process, thereby exposing sensitive data. While no local privilege escalation or remote code execution is available, the impact on confidentiality and audit integrity can be significant for compromised applications.