CVE-2026-55878
1 advisory.
Packagist/symfony/ux-toolkit CVE-2026-55878: high 7.8
symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest
Action: Upgrade symfony/ux-toolkit to 2.36.1 or later.
composer require symfony/ux-toolkit:2.36.1composer require symfony/ux-toolkit:3.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.32.0 | 2.36.1 | - |
| 3.0.0 | 3.2.0 | - |
Fixed versions
| 2.36.1 | 3.2.0 |
Sources
- osv: GHSA-p9xj-fpr2-jf2q
- https://github.com/symfony/ux/security/advisories/GHSA-p9xj-fpr2-jf2q
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-toolkit/CVE-2026-55878.yaml
- https://github.com/symfony/ux
CVE-2026-55878 · published · modified · JSON