Is there a patch available for CVE-2026-45072?

Yes, a patch is available for CVE-2026-45072. Update the affected software to the latest version immediately.

Symfony WebProfiler CVE-2026-45072

Q: What is the CVSS score of CVE-2026-45072?

CVE-2026-45072 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

Q: Which versions of Symfony WebProfiler are affected by CVE-2026-45072?

Stored XSS in Symfony's WebProfiler `CodeExtension::fileExcerpt()` allows JavaScript execution in a developer's browser when the profiler renders non-PHP files containing attacker-controlled content.. A patch is available.

EUVD-2026-44366 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 https://github.com/symfony/symfony

GHSA-hmr5-2xcr-v8pp

XSS PHP

2.0

CVSS 4.0 · Vendor: https://github.com/symfony/symfony

Severity by source

Vendor (https://github.com/symfony/symfony) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (https://github.com/symfony/symfony) · only source for this CVE.

CVSS VectorVendor: https://github.com/symfony/symfony

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jul 14, 2026 - 19:22 NVD

2.0 (LOW)

Source Code Evidence Fetched

May 27, 2026 - 22:16 vuln.today

Analysis Generated

May 27, 2026 - 22:16 vuln.today

DescriptionCVE.org

Description

Symfony's profiler, a development only debug UI, renders source-code excerpts on several pages using Twig's custom file_excerpt filter. This filter renders PHP files via highlight_string() (which escapes HTML), but renders non-PHP files by splitting on \n and interpolating each line directly into <code>{$line}</code> with no escaping.

An attacker who can write arbitrary bytes into any file under the project root (including e.g. var/log/dev.log), achieves stored XSS against any developer who later opens that file in the profiler.

Resolution

The file_excerpt filter now properly escapes each line of non-PHP files using htmlspecialchars() before concatenating them.

The patch for this issue is available here for branch 6.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

AnalysisAI

Stored XSS in Symfony's WebProfiler CodeExtension::fileExcerpt() allows JavaScript execution in a developer's browser when the profiler renders non-PHP files containing attacker-controlled content. Affected are symfony/symfony 6.4.24-6.4.39, 7.2.9-7.4.11, and 8.0.0-8.0.11, along with symfony/twig-bridge 6.4.24-6.4.39. The attack requires a separate write primitive to any file under the project root - log poisoning via var/log/dev.log is the canonical vector - after which exploitation is reliable and requires only developer interaction with the profiler. No public exploit has been identified at time of analysis, and the vulnerability is scoped to development environments only.

Technical ContextAI

The vulnerable code resides in src/Symfony/Bridge/Twig/Extension/CodeExtension.php within the fileExcerpt() method, which is exposed as a custom Twig filter used across multiple WebProfiler pages to render source-code excerpts. PHP files are safely processed through highlight_string(), which internally HTML-encodes output. However, non-PHP files (HTML, YAML, JavaScript, log files, and any other extension) were handled by splitting raw file contents on newlines and interpolating each line directly into <code>{$line}</code> without sanitization - a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) sink. The fix, confirmed in commit 863aa81c, moves the htmlspecialchars($contents, ENT_QUOTES | ENT_SUBSTITUTE, $charset) call to apply to the entire file contents before the newline split, ensuring all lines are safe before HTML interpolation. Affected packages are pkg:composer/symfony/symfony, pkg:composer/symfony/twig-bridge, and pkg:composer/symfony/web-profiler-bundle.

RemediationAI

Upgrade to the vendor-released patched versions: symfony/symfony 6.4.40 (for the 6.4.x track), 7.4.12 (for 7.x), or 8.0.12 (for 8.0.x), and symfony/twig-bridge 6.4.40. Run composer update symfony/symfony symfony/twig-bridge symfony/web-profiler-bundle and verify installed versions. The patch is confirmed at commit 863aa81c61166f1aa74b7732df316f76113acbdb (https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb). As a compensating control prior to patching, ensure the WebProfiler is fully disabled in any shared, staging, or CI environment by setting web_profiler.toolbar: false and web_profiler.intercept_redirects: false in the environment config, or by verifying APP_ENV=prod. Restricting the /_profiler route to localhost-only via web server ACL reduces exposure but does not eliminate the vulnerability if developers access profiler remotely. Full advisory: https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp.