Packagist/symfony/web-profiler-bundle CVE-2026-45072: medium 5.4, EPSS 0.30%
Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
Action: Upgrade symfony/web-profiler-bundle to 7.4.12 or later.
composer require symfony/web-profiler-bundle:7.4.12composer require symfony/web-profiler-bundle:8.0.12Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.2.9 | 7.4.12 | - |
| 8.0.0 | 8.0.12 | - |
Fixed versions
| 7.4.12 | 8.0.12 |
Sources
- osv: GHSA-hmr5-2xcr-v8pp#Packagist/symfony/web-profiler-bundle
- nvd: CVE-2026-45072
- https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp
- https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45072.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/twig-bridge/CVE-2026-45072.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/web-profiler-bundle/CVE-2026-45072.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45072
CVE-2026-45072 · published · modified · JSON