Every CVE Search/ Get API key

CVE-2026-45071

Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

8.7 HighPublic exploitFix available

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.57%Up 0.5 points since Jun 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Record
CVE-2026-45071
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-611
Updated
2026-11-02
EUVDEUVD-2026-44368 8.7

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Record
EUVD-2026-44368
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-x6g4-fwcc-jj8w 1.3

Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

Description

symfony/dom-crawler provides the Crawler class for navigating HTML/XML documents with CSS/XPath selectors; symfony/browser-kit's HttpBrowser uses it to parse fetched pages.

Crawler::addXmlContent() sets DOMDocument::$validateOnParse = true before calling loadXML(). Setting validateOnParse re-enables libxml's DTD subset processing, including external entity resolution, even though LIBXML_NONET is passed. LIBXML_NONET blocks network fetches but not file:// entities. An attacker-supplied XML document with a SYSTEM "file:///etc/passwd" entity is therefore expanded.

Resolution

The Crawler::addXmlContent method does not set the validateOnParse flag anymore.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Record
GHSA-x6g4-fwcc-jj8w
CVSS 4.0
1.3 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-611
Updated
2026-11-02
NVD 8.7

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Record
CVE-2026-45071
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-611
Updated
2026-11-02
OSV 8.7

Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Record
CVE-2026-45071
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-611
Updated
2026-11-02
OSVDEBIAN-CVE-2026-45071 7.5

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Record
DEBIAN-CVE-2026-45071
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-x6g4-fwcc-jj8w 1.3

Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

Description

symfony/dom-crawler provides the Crawler class for navigating HTML/XML documents with CSS/XPath selectors; symfony/browser-kit's HttpBrowser uses it to parse fetched pages.

Crawler::addXmlContent() sets DOMDocument::$validateOnParse = true before calling loadXML(). Setting validateOnParse re-enables libxml's DTD subset processing, including external entity resolution, even though LIBXML_NONET is passed. LIBXML_NONET blocks network fetches but not file:// entities. An attacker-supplied XML document with a SYSTEM "file:///etc/passwd" entity is therefore expanded.

Resolution

The Crawler::addXmlContent method does not set the validateOnParse flag anymore.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Record
GHSA-x6g4-fwcc-jj8w
CVSS 4.0
1.3 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-611
Updated
2026-11-02
OSVUBUNTU-CVE-2026-45071 8.7

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Record
UBUNTU-CVE-2026-45071
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
symfony/dom-crawler
Packagist
 before 5.4.52
5.4.52
symfony/symfony
Packagist
 before 5.4.52
5.4.52
symfony/dom-crawler
Packagist
 6.0.0 up to 6.4.40
6.4.40
symfony/dom-crawler
Packagist
 7.0.0 up to 7.4.12
7.4.12
symfony/dom-crawler
Packagist
 8.0.0 up to 8.0.12
8.0.12
symfony/symfony
Packagist
 6.0.0 up to 6.4.40
6.4.40
symfony/symfony
Packagist
 7.0.0 up to 7.4.12
7.4.12
symfony/symfony
Packagist
 8.0.0 up to 8.0.12
8.0.12
symfony
Debian:12
 before 5.4.53+dfsg-0+deb12u1, plus listed versions
5.4.23+dfsg-15.4.23+dfsg-1+deb12u15.4.23+dfsg-1+deb12u25.4.23+dfsg-1+deb12u35.4.23+dfsg-1+deb12u4
Show 17 moreShow less
5.4.23+dfsg-1+deb12u55.4.24+dfsg-15.4.25+dfsg-15.4.27+dfsg-15.4.28+dfsg-15.4.29+dfsg-15.4.30+dfsg-15.4.31+dfsg-15.4.31+dfsg-25.4.32+dfsg-15.4.33+dfsg-15.4.34+dfsg-15.4.34+dfsg-25.4.35+dfsg-15.4.35+dfsg-25.4.35+dfsg-35.4.52+dfsg-0+deb12u1
5.4.53+dfsg-0+deb12u1
symfony
Debian:13
 before 6.4.41+dfsg-0+deb13u1, plus listed versions
6.4.21+dfsg-26.4.21+dfsg-2+deb13u16.4.24+dfsg-16.4.25+dfsg-16.4.40+dfsg-0+deb13u1
6.4.41+dfsg-0+deb13u1
Show 17 moreShow less
Affected packages
PackageAffectedFixed
symfony
Debian:14
 before 7.4.12+dfsg-1, plus listed versions
6.4.21+dfsg-26.4.24+dfsg-16.4.25+dfsg-17.0.4+dfsg-17.0.5+dfsg-1
Show 45 moreShow less
7.0.6+dfsg-17.0.7+dfsg-17.1.0~beta1+dfsg-17.1.0~rc1+dfsg-17.1.2+dfsg-17.1.3+dfsg-17.1.4+dfsg-17.1.5+dfsg-17.2.0~beta1+dfsg-17.2.0~beta2+dfsg-17.2.0~rc1+dfsg-17.2.1+dfsg-17.2.2+dfsg-17.2.3+dfsg-17.2.4+dfsg-17.2.5+dfsg-17.2.6-17.3.0+dfsg-17.3.0~beta1+dfsg-17.3.0~beta2+dfsg-17.3.0~rc1+dfsg-17.3.1+dfsg-17.3.2+dfsg-17.3.3+dfsg-17.3.4+dfsg-17.3.5-17.4.0+dfsg-17.4.0+dfsg-27.4.0~beta1-17.4.0~beta1-27.4.0~beta2+dfsg-17.4.0~beta2+dfsg-27.4.0~beta2+dfsg-37.4.0~rc1+dfsg-17.4.0~rc2+dfsg-17.4.0~rc3+dfsg-17.4.10+dfsg-17.4.2+dfsg-17.4.2+dfsg-27.4.3+dfsg-17.4.4+dfsg-17.4.5+dfsg-17.4.6+dfsg-17.4.6+dfsg-27.4.7+dfsg-1
7.4.12+dfsg-1
symfony/dom-crawler
Packagist
 before 5.4.52, plus listed versions
2.0.42.0.52.0.62.0.7v2.0.10
Show 45 moreShow less
v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11
5.4.52
symfony/symfony
Packagist
 before 5.4.52, plus listed versions
2.0.42.0.52.0.62.0.7v2.0.10
Show 45 moreShow less
v2.0.11v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.0-BETA1v2.1.0-BETA2v2.1.0-BETA3v2.1.0-BETA4v2.1.0-RC1v2.1.0-RC2v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.0-BETA1v2.2.0-BETA2v2.2.0-RC1v2.2.0-RC2v2.2.0-RC3v2.2.1v2.2.10v2.2.11
5.4.52
symfony/dom-crawler
Packagist
 6.0.0 up to 6.4.40, plus listed versions
v6.0.0v6.0.1v6.0.11v6.0.12v6.0.15
Show 45 moreShow less
v6.0.17v6.0.19v6.0.2v6.0.3v6.0.5v6.0.6v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-BETA2v6.1.0-RC1v6.1.11v6.1.3v6.1.4v6.1.7v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA2v6.2.0-BETA3v6.2.0-RC1v6.2.12v6.2.3v6.2.5v6.2.7v6.2.8v6.2.9v6.3.0v6.3.0-BETA1v6.3.0-RC1v6.3.1v6.3.12v6.3.4v6.3.9v6.4.0v6.4.0-BETA1v6.4.0-BETA2v6.4.0-RC1v6.4.0-RC2v6.4.12v6.4.13v6.4.16v6.4.18v6.4.19v6.4.23
6.4.40
symfony/dom-crawler
Packagist
 7.0.0 up to 7.4.12, plus listed versions
v7.0.0v7.0.3v7.0.4v7.0.7v7.0.8
Show 28 moreShow less
v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.11v7.1.5v7.1.6v7.1.9v7.2.0v7.2.0-BETA1v7.2.0-RC1v7.2.3v7.2.4v7.2.8v7.3.0v7.3.0-BETA1v7.3.0-RC1v7.3.1v7.3.10v7.3.3v7.4.0v7.4.0-BETA1v7.4.0-BETA2v7.4.0-RC1v7.4.1v7.4.4v7.4.6v7.4.8
7.4.12
symfony/dom-crawler
Packagist
 8.0.0 up to 8.0.12, plus listed versions
v8.0.0v8.0.1v8.0.4v8.0.6v8.0.8
8.0.12
symfony/symfony
Packagist
 6.0.0 up to 6.4.40, plus listed versions
v6.0.0v6.0.1v6.0.10v6.0.11v6.0.12
Show 45 moreShow less
v6.0.13v6.0.14v6.0.15v6.0.16v6.0.17v6.0.18v6.0.19v6.0.2v6.0.20v6.0.3v6.0.4v6.0.5v6.0.6v6.0.7v6.0.8v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-BETA2v6.1.0-RC1v6.1.1v6.1.10v6.1.11v6.1.12v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.8v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA2v6.2.0-BETA3v6.2.0-RC1v6.2.0-RC2v6.2.1v6.2.10v6.2.11v6.2.12v6.2.13v6.2.14v6.2.2
6.4.40
symfony/symfony
Packagist
 7.0.0 up to 7.4.12, plus listed versions
v7.0.0v7.0.1v7.0.10v7.0.2v7.0.3
Show 45 moreShow less
v7.0.4v7.0.5v7.0.6v7.0.7v7.0.8v7.0.9v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.10v7.1.11v7.1.2v7.1.3v7.1.4v7.1.5v7.1.6v7.1.7v7.1.8v7.1.9v7.2.0v7.2.0-BETA1v7.2.0-BETA2v7.2.0-RC1v7.2.1v7.2.2v7.2.3v7.2.4v7.2.5v7.2.6v7.2.7v7.2.8v7.2.9v7.3.0v7.3.0-BETA1v7.3.0-BETA2v7.3.0-RC1v7.3.1v7.3.10v7.3.11v7.3.2v7.3.3v7.3.4v7.3.5v7.3.6
7.4.12
symfony/symfony
Packagist
 8.0.0 up to 8.0.12, plus listed versions
v8.0.0v8.0.1v8.0.10v8.0.11v8.0.2
Show 7 moreShow less
v8.0.3v8.0.4v8.0.5v8.0.6v8.0.7v8.0.8v8.0.9
8.0.12
symfony
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.7.1+dfsg-12.7.5+dfsg-12.7.9+dfsg-12.7.9+dfsg-1ubuntu22.7.10-0ubuntu2
 None known
symfony
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.13.4.6+dfsg-1ubuntu0.1+esm13.4.6+dfsg-1ubuntu0.1+esm2
 None known
symfony
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.3.4+dfsg-1ubuntu14.3.8+dfsg-1ubuntu14.3.8+dfsg-1ubuntu1+esm14.3.8+dfsg-1ubuntu1+esm2
 None known
symfony
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.2.6+dfsg-1ubuntu75.4.4+dfsg-1ubuntu85.4.4+dfsg-1ubuntu8+esm1
 None known
symfony
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
5.4.23+dfsg-1ubuntu15.4.35+dfsg-3ubuntu16.4.5+dfsg-3ubuntu26.4.5+dfsg-3ubuntu36.4.5+dfsg-3ubuntu3+esm1
 None known
symfony
Ubuntu:25.10
 All versions, plus listed versions
6.4.18+dfsg-1ubuntu16.4.21+dfsg-26.4.21+dfsg-2ubuntu16.4.24+dfsg-1
 None known
symfony
Ubuntu:26.10
 All versions, plus listed versions
7.4.7+dfsg-1ubuntu17.4.9+dfsg-1ubuntu17.4.13+dfsg-2ubuntu17.4.14+dfsg-1ubuntu27.4.15+dfsg-2ubuntu27.4.16+dfsg-1ubuntu2
 None known
symfony
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.4.24+dfsg-17.4.5+dfsg-1ubuntu17.4.6+dfsg-2ubuntu17.4.7+dfsg-1ubuntu1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubbozellqp/zk-xml-probe2026-08-29

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-45071 is a high vulnerability (CVSS 8.7) in Sensiolabs Symfony, published May 27, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in symfony/dom-crawler 5.4.52.

References

Show 11 moreShow less
This page doesn't list everything

Left out here: 1,168 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open