CVE-2026-45072: Stored XSS in WebProfiler CodeExtension::fileExcerpt(): Unescaped Non-PHP File Rendering
Description
Symfony's profiler, a development only debug UI, renders source-code excerpts on several pages using Twig's custom fileexcerpt filter. This filter renders PHP files via highlightstring() (which escapes HTML), but renders non-PHP files by splitting on \n and interpolating each line directly into <code>{$line}</code> with no escaping.
An attacker who can write arbitrary bytes into any file under the project root (including e.g. var/log/dev.log), achieves stored XSS against any developer who later opens that file in the profiler.
Resolution
The fileexcerpt filter now properly escapes each line of non-PHP files using htmlspecialchars() before concatenating them.
The patch for this issue is available here for branch 6.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
Other sources
CVE-2026-45072: Stored XSS in WebProfiler CodeExtension::fileExcerpt(): Unescaped Non-PHP File Rendering
— Packagist
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler fileexcerpt Twig filter escapes PHP files through highlightstring() but interpolates lines from non-PHP files directly into <code> elements, allowing stored XSS against a developer who opens an attacker-written file such as var/log/dev.log in the profiler. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/web-profiler-bundleto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/web-profiler-bundleto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/twig-bridgeto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
debian/symfonyto a version that resolves this vulnerability.Fixed in 5.4.53+dfsg-0+deb12u1Fixed in 6.4.41+dfsg-0+deb13u1Fixed in 6.4.49+dfsg-0+deb13u1Fixed in 7.4.22+dfsg-1Fixed in 7.4.23+dfsg-1 - Upgrade
Upgrade
Symfonyto a version that resolves this vulnerability.Fixed in 6.4.40Patch 863aa81c61166f1aa74b7732df316f76113acbdb
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45072?
CVE-2026-45072 has a risk rating of 30.
How do I fix CVE-2026-45072?
To fix CVE-2026-45072, update to the latest patched version of the Symfony components affected.
What types of files are vulnerable in CVE-2026-45072?
CVE-2026-45072 affects the rendering of non-PHP files using Twig's `file_excerpt` filter.
What vulnerability type is CVE-2026-45072 classified under?
CVE-2026-45072 is classified under Cross-Site Scripting (XSS) vulnerabilities.
Which Symfony packages are impacted by CVE-2026-45072?
The impacted Symfony packages include composer/symfony/symfony, composer/symfony/web-profiler-bundle, and composer/symfony/twig-bridge.