Skip to content
Symfony Ux vulnerabilities
-
symfony ux
Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest
CVE-2026-55878
Fix available
7.8 High
-
symfony ux
Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses
CVE-2026-55877
Fix available
6.1 Medium
-
symfony ux
Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data
CVE-2026-49216
Fix available
5.1 Medium
-
symfony ux
Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted
CVE-2026-49215
Fix available
2.1 Low
-
symfony ux
Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding
CVE-2026-49212
Fix available
6.9 Medium
-
symfony ux
Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
CVE-2026-49211
Fix available
6.9 Medium
-
symfony ux
Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag
CVE-2026-49210
Fix available
2.3 Low
-
symfony ux
Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests
CVE-2026-49209
Fix available
5.3 Medium
-
symfony ux
Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor
CVE-2026-49208
Fix available
6.9 Medium
-
symfony ux
symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes
CVE-2025-47946
Fix available
6.1 Medium
-
symfony ux-autocomplete, ux autocomplete +1 more
Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete
CVE-2023-41336
Fix available
6.5 Medium