EUVD-2026-44368
GHSA-x6g4-fwcc-jj8w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify app parsing untrusted XML via DomCrawler
-
DeliveryCraft XML with file:// SYSTEM entity
-
ExploitSubmit payload to addXmlContent path
-
Executionlibxml expands external entity
-
PersistRead local file via crawler output
-
ImpactExfiltrate disclosed file contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration XML external entity prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to call Crawler::addXmlContent() (or a BrowserKit/HttpBrowser flow that parses XML responses) on attacker-controlled XML content, and to expose the resulting parsed text/nodes back to the attacker for the disclosed file contents to be observed. The attacker-supplied XML must contain a DTD declaring an external SYSTEM entity with a file:// URI referencing a readable local file; only local file:// (and other non-network libxml protocols) work because LIBXML_NONET blocks network entity fetches. Limiting factors: the app must specifically use the XML parsing path (addXmlContent, not addHtmlContent), must feed it untrusted input, and must reflect parsed output; there is no code execution or write, and impact is confined to files readable by the PHP process. Affected only on Symfony DomCrawler versions before 5.4.52 / 6.4.40 / 7.4.12 / 8.0.12. |
| Impact | Signals are consistent and point to a real but conditional file-disclosure issue rather than a mass-exploitation event. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) yields 8.7 and reflects unauthenticated network reachability with only high confidentiality impact and no integrity or availability impact, matching a read-only XXE. EPSS is very low (0.05%), there is no KEV listing and no public exploit identified, so this is not under active or automatable mass exploitation. The practical caveat is that the CVSS base treats the flaw as network-triggerable with no privileges, but real exploitation depends on the target application actually calling addXmlContent() on untrusted XML and surfacing the parsed text back to the attacker - a code-path precondition not captured by the base vector. The impact is limited to confidentiality (local file/SSRF-style disclosure); there is no code execution or write. Net: patch on a normal cycle; treat as elevated only where apps parse third-party XML with DomCrawler and echo results. |
| Exploit ScenarioDerived | An attacker submits an XML document (e.g., via an upload, API body, or a page fetched by HttpBrowser) that a Symfony application parses with Crawler::addXmlContent(); the document declares an external entity like <!DOCTYPE r [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><r>&xxe;</r>. libxml expands the entity, and when the application reads the crawler's text() output the contents of the local file are returned to the attacker. No public exploit is identified at time of analysis, but the vendor's fix commit includes a proof test (testAddXmlContentDoesNotExpandExternalEntities) demonstrating the file:// entity behavior. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 14, 2026
XML External Entity (XXE) local file disclosure in Symfony's DomCrawler component allows remote attackers to read arbitrary server-side files when an application parses attacker-controlled XML via Crawler::addXmlContent(). The method explicitly set DOMDocument::$validateOnParse = true, which re-enabled libxml DTD subset processing and external entity resolution; because LIBXML_NONET only blocks network fetches and not file:// entities, an entity such as SYSTEM "file:///etc/passwd" is expanded and its contents exposed. EPSS is very low (0.05%, 17th percentile) and there is no public exploit identified at time of analysis, though the vendor commit ships a demonstrative test case.
Earlier versions of this analysis (1)
Local file disclosure via XXE in Symfony's DomCrawler component exposes arbitrary server-side files to attackers who can supply malicious XML to any application calling Crawler::addXmlContent(). The root cause is a single validateOnParse = true assignment that inadvertently re-enables libxml's DTD entity resolution, bypassing the LIBXML_NONET network-block flag since that flag does not prevent file:// URI resolution. No active exploitation is confirmed (not in CISA KEV), but the patch commit's own regression test documents the exact exploit payload, effectively constituting public proof-of-concept documentation.
RemediationAI
Upgrade to a fixed release: Symfony 5.4.52, 6.4.40, 7.4.12, or 8.0.12 (Vendor-released patch confirmed via release tags and commit eea5fd7488cbdc241da4ce242344b7d9a3ecdf3d, which removes the $dom->validateOnParse = true line from Crawler::addXmlContent). Run composer update symfony/dom-crawler (or symfony/symfony) to the corresponding patched version for your branch. If you cannot upgrade immediately, avoid passing untrusted XML to Crawler::addXmlContent()/addContent() - parse third-party XML yourself with libxml_set_external_entity_loader() set to reject file:// (and non-http) URIs, or pre-strip/reject any DOCTYPE/DTD before handing content to the Crawler; the trade-off is added parsing code and potential breakage of legitimate documents that rely on a DTD. For HttpBrowser-based crawling, restrict which hosts/content are fetched and parsed. Advisory and patch references: https://github.com/symfony/symfony/security/advisories/GHSA-x6g4-fwcc-jj8w and https://github.com/symfony/symfony/commit/eea5fd7488cbdc241da4ce242344b7d9a3ecdf3d.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 10 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is Symfony's DomCrawler component (package composer/symfony/dom-crawler, also bundled in the symfony/symfony monolith), which wraps PHP's ext-dom / libxml DOMDocument to let developers navigate HTML and XML with CSS and XPath selectors. Symfony's BrowserKit HttpBrowser uses the same Crawler to parse fetched pages, broadening the exposure to HTTP client / crawling workflows. The root cause is CWE-611 (Improper Restriction of XML External Entity Reference): Crawler::addXmlContent() called DOMDocument::loadXML() with LIBXML_NONET but first toggled $validateOnParse = true. Enabling validation forces libxml to process the internal DTD subset, which includes resolving declared external entities; LIBXML_NONET stops http(s)/ftp network retrieval but does not restrict local file:// URIs, so external entities pointing at local files are still dereferenced and inlined into the parsed document text.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated attacker supplies XML with no added complexity (AV:N/AC:L/PR:N/UI:N); impact is local file disclosure so C:H, I:N, A:N; no code executes outside the component so S:N.
Primary rating from Vendor (https://github.com/symfony/symfony).
CVSS VectorVendor: https://github.com/symfony/symfony
Lifecycle Timeline
1DescriptionCVE.org
Description
symfony/dom-crawler provides the Crawler class for navigating HTML/XML documents with CSS/XPath selectors; symfony/browser-kit's HttpBrowser uses it to parse fetched pages.
Crawler::addXmlContent() sets DOMDocument::$validateOnParse = true before calling loadXML(). Setting validateOnParse re-enables libxml's DTD subset processing, including external entity resolution, even though LIBXML_NONET is passed. LIBXML_NONET blocks network fetches but not file:// entities. An attacker-supplied XML document with a SYSTEM "file:///etc/passwd" entity is therefore expanded.
Resolution
The Crawler::addXmlContent method does not set the validateOnParse flag anymore.
The patch for this issue is available here for branch 5.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
Executive ViewAI
Symfony's DomCrawler component contains an XML External Entity (XXE) vulnerability (CVE-2026-45071, CVSS 8.7) that allows remote attackers to read arbitrary server files. While technically severe, no public exploit identified at time of analysis, and exploitation likelihood is extremely low (EPSS 0.1%, 17th percentile). Organizations should apply available patches within normal timelines.
Patch available per vendor advisory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.
Exploit-DB