CVE-2026-45072
3 advisories.
Packagist/symfony/symfony CVE-2026-45072: low, EPSS 0.30%
Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
Action: Upgrade symfony/symfony to 6.4.40 or later.
composer require symfony/symfony:6.4.40composer require symfony/symfony:7.4.12composer require symfony/symfony:8.0.12Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.4.24 | 6.4.40 | - |
| 7.2.9 | 7.4.12 | - |
| 8.0.0 | 8.0.12 | - |
Fixed versions
| 6.4.40 | 7.4.12 | 8.0.12 |
Sources
- osv: GHSA-hmr5-2xcr-v8pp
- https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp
- https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45072.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/twig-bridge/CVE-2026-45072.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/web-profiler-bundle/CVE-2026-45072.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45072
CVE-2026-45072 · published · modified · JSON
Packagist/symfony/twig-bridge CVE-2026-45072: low, EPSS 0.30%
Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
Action: Upgrade symfony/twig-bridge to 6.4.40 or later.
composer require symfony/twig-bridge:6.4.40Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.4.24 | 6.4.40 | - |
Fixed versions
| 6.4.40 |
Sources
- osv: GHSA-hmr5-2xcr-v8pp#Packagist/symfony/twig-bridge
- https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp
- https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45072.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/twig-bridge/CVE-2026-45072.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/web-profiler-bundle/CVE-2026-45072.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45072
CVE-2026-45072 · published · modified · JSON
Packagist/symfony/web-profiler-bundle CVE-2026-45072: low, EPSS 0.30%
Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
Action: Upgrade symfony/web-profiler-bundle to 7.4.12 or later.
composer require symfony/web-profiler-bundle:7.4.12composer require symfony/web-profiler-bundle:8.0.12Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.2.9 | 7.4.12 | - |
| 8.0.0 | 8.0.12 | - |
Fixed versions
| 7.4.12 | 8.0.12 |
Sources
- osv: GHSA-hmr5-2xcr-v8pp#Packagist/symfony/web-profiler-bundle
- https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp
- https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45072.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/twig-bridge/CVE-2026-45072.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/web-profiler-bundle/CVE-2026-45072.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45072
CVE-2026-45072 · published · modified · JSON