CVE-2026-45072

Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering

Published Jul 14, 2026 CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler file_excerpt Twig filter escapes PHP files through highlight_string() but interpolates lines from non-PHP files directly into <code> elements, allowing stored XSS against a developer who opens an attacker-written file such as var/log/dev.log in the profiler. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

Analysis

Technical impact

Symfony’s WebProfiler component contains a stored Cross‑Site Scripting flaw in the file_excerpt Twig filter. The filter escapes PHP files with highlight_string() but inserts raw lines from non‑PHP files, such as log files, directly into <code> elements. When a developer opens an attacker‑crafted file (for example, a malicious var/log/dev.log) in the profiler, the unescaped content is executed as JavaScript within that developer’s browser session. This vulnerability is recognized as CWE‑79 and exists in Symfony versions 6.4.24 through 6.4.39, 7.4.0 through 7.4.11, and 8.0.0 through 8.0.11; it was fixed in releases 6.4.40, 7.4.12, and 8.0.12.

Affected Systems

The issue affects the Symfony Core framework, the Twig Bridge component, and the WebProfiler bundle. Unpatched versions include 6.4.24 through 6.4.39, 7.4.0 through 7.4.11, and 8.0.0 through 8.0.11; the problem is resolved in releases 6.4.40, 7.4.12, and 8.0.12.

Risk and Exploitability

With a CVSS score of 2, the overall severity is low, and the EPSS score of less than 1 % indicates a very low likelihood of exploitation in practice. The vulnerability is not listed in the CISA KEV catalog. Attackers must first place a malicious file on the server and then have a developer who opens that file in the profiler to trigger the XSS; therefore the attack vector is limited to development and debugging environments, but the impact on the targeted developer can be significant.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

symfony

affected

Version	Status	Constraints
`>= 6.4.24, < 6.4.40`	affected	—
`>= 7.2.9, < 7.4.12`	affected	—
`>= 8.0.0-BETA1, < 8.0.12`	affected	—

symfony

twig-bridge

affected

Version	Status	Constraints
`>= 6.4.24, < 6.4.40`	affected	—

symfony

web-profiler-bundle

affected

Version	Status	Constraints
`>= 7.2.9, < 7.4.12`	affected	—
`>= 8.0.0-BETA1, < 8.0.12`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:sensiolabs:symfony::::::::
	cpe:2.3:a:sensiolabs:symfony::::::::
	cpe:2.3:a:sensiolabs:symfony::::::::

No data.

Vendor Product Versions

Symfony

Version	Status	Scheme	Platform
`[6.4.24,6.4.40)`	affected	semver	—
`[7.2.9,7.4.12)`	affected	semver	—
`[8.0.0-BETA1,8.0.12)`	affected	semver	—

Symfony

Twig-bridge

Version	Status	Scheme	Platform
`[6.4.24,6.4.40)`	affected	semver	—

Symfony

Web-profiler-bundle

Version	Status	Scheme	Platform
`[7.2.9,7.4.12)`	affected	semver	—
`[8.0.0-BETA1,8.0.12)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Symfony, the Twig Bridge component, and the WebProfiler bundle to the fixed releases v6.4.40, v7.4.12, or v8.0.12 and later.
Restart the application to ensure the updated code is active.
If the application is already in production, disable or restrict access to the WebProfiler route so that non‑privileged users cannot trigger the rendering of non‑PHP file excerpts.
Remove any attacker‑controlled or unnecessary log files that the profiler could display.

Generated by OpenCVE AI on July 31, 2026 at 05:49 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6312-1	symfony security update
Github GHSA	GHSA-hmr5-2xcr-v8pp	Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.305% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb
https://github.com/symfony/symfony/releases/tag/v6.4.40
https://github.com/symfony/symfony/releases/tag/v7.4.12
https://github.com/symfony/symfony/releases/tag/v8.0.12
https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp

History

Jul 27, 2026 3:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Symfony Symfony symfony Symfony twig-bridge Symfony web-profiler-bundle
Vendors & Products		Symfony Symfony symfony Symfony twig-bridge Symfony web-profiler-bundle

Jul 15, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 6:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler file_excerpt Twig filter escapes PHP files through highlight_string() but interpolates lines from non-PHP files directly into <code> elements, allowing stored XSS against a developer who opens an attacker-written file such as var/log/dev.log in the profiler. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Title		Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
Weaknesses		CWE-79
References		https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb https://github.com/symfony/symfony/releases/tag/v6.4.40 https://github.com/symfony/symfony/releases/tag/v7.4.12 https://github.com/symfony/symfony/releases/tag/v8.0.12 https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp
Metrics		cvssV4_0 `{'score': 2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`