Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler file_excerpt Twig filter escapes PHP files through highlight_string() but interpolates lines from non-PHP files directly into <code> elements, allowing stored XSS against a developer who opens an attacker-written file such as var/log/dev.log in the profiler. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Published: 2026-07-14
Score: 2 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Symfony’s WebProfiler component contains a stored Cross‑Site Scripting flaw in the file_excerpt Twig filter. The filter escapes PHP files with highlight_string() but inserts raw lines from non‑PHP files, such as log files, directly into <code> elements. When a developer opens an attacker‑crafted file (for example, a malicious var/log/dev.log) in the profiler, the unescaped content is executed as JavaScript within that developer’s browser session. This vulnerability is recognized as CWE‑79 and exists in Symfony versions 6.4.24 through 6.4.39, 7.4.0 through 7.4.11, and 8.0.0 through 8.0.11; it was fixed in releases 6.4.40, 7.4.12, and 8.0.12.

Affected Systems

The issue affects the Symfony Core framework, the Twig Bridge component, and the WebProfiler bundle. Unpatched versions include 6.4.24 through 6.4.39, 7.4.0 through 7.4.11, and 8.0.0 through 8.0.11; the problem is resolved in releases 6.4.40, 7.4.12, and 8.0.12.

Risk and Exploitability

With a CVSS score of 2, the overall severity is low, and the EPSS score of less than 1 % indicates a very low likelihood of exploitation in practice. The vulnerability is not listed in the CISA KEV catalog. Attackers must first place a malicious file on the server and then have a developer who opens that file in the profiler to trigger the XSS; therefore the attack vector is limited to development and debugging environments, but the impact on the targeted developer can be significant.

Generated by OpenCVE AI on July 31, 2026 at 05:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Symfony, the Twig Bridge component, and the WebProfiler bundle to the fixed releases v6.4.40, v7.4.12, or v8.0.12 and later.
  • Restart the application to ensure the updated code is active.
  • If the application is already in production, disable or restrict access to the WebProfiler route so that non‑privileged users cannot trigger the rendering of non‑PHP file excerpts.
  • Remove any attacker‑controlled or unnecessary log files that the profiler could display.

Generated by OpenCVE AI on July 31, 2026 at 05:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6312-1 symfony security update
Github GHSA Github GHSA GHSA-hmr5-2xcr-v8pp Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
History

Mon, 27 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Symfony
Symfony symfony
Symfony twig-bridge
Symfony web-profiler-bundle
Vendors & Products Symfony
Symfony symfony
Symfony twig-bridge
Symfony web-profiler-bundle

Wed, 15 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Description Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler file_excerpt Twig filter escapes PHP files through highlight_string() but interpolates lines from non-PHP files directly into <code> elements, allowing stored XSS against a developer who opens an attacker-written file such as var/log/dev.log in the profiler. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Title Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Symfony Symfony Twig-bridge Web-profiler-bundle
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-15T13:26:50.587Z

Reserved: 2026-05-08T18:45:10.096Z

Link: CVE-2026-45072

cve-icon Vulnrichment

Updated: 2026-07-15T13:26:45.951Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T06:00:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')