CVE-2026-45071: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
Description
symfony/dom-crawler provides the Crawler class for navigating HTML/XML documents with CSS/XPath selectors; symfony/browser-kit's HttpBrowser uses it to parse fetched pages.
Crawler::addXmlContent() sets DOMDocument::$validateOnParse = true before calling loadXML(). Setting validateOnParse re-enables libxml's DTD subset processing, including external entity resolution, even though LIBXMLNONET is passed. LIBXMLNONET blocks network fetches but not file:// entities. An attacker-supplied XML document with a SYSTEM "file:///etc/passwd" entity is therefore expanded.
Resolution
The Crawler::addXmlContent method does not set the validateOnParse flag anymore.
The patch for this issue is available here for branch 5.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
Other sources
CVE-2026-45071: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
— Packagist
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/dom-crawlerto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/dom-crawlerto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/dom-crawlerto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
composer/symfony/dom-crawlerto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
debian/symfonyto a version that resolves this vulnerability.Fixed in 5.4.53+dfsg-0+deb12u1Fixed in 6.4.41+dfsg-0+deb13u1Fixed in 6.4.49+dfsg-0+deb13u1Fixed in 7.4.22+dfsg-1Fixed in 7.4.23+dfsg-1 - Upgrade
Upgrade
symfony/dom-crawlerto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
symfony/dom-crawlerto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
symfony/dom-crawlerto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
symfony/dom-crawlerto a version that resolves this vulnerability.Fixed in 8.0.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45071?
The severity of CVE-2026-45071 is rated at risk level 45.
How do I fix CVE-2026-45071?
To fix CVE-2026-45071, update the symfony/dom-crawler and symfony/browser-kit packages to their latest versions.
What are the potential impacts of CVE-2026-45071?
CVE-2026-45071 may lead to XML External Entity (XXE) attacks, which can compromise sensitive data.
Which versions of Symfony are affected by CVE-2026-45071?
CVE-2026-45071 affects specific versions of composer/symfony/symfony and composer/symfony/dom-crawler prior to the security update.
Is CVE-2026-45071 exploitable remotely?
Yes, CVE-2026-45071 can be exploited remotely if the affected components are exposed to users who can trigger XML parsing.