CVE-2026-45072: Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
Description
Symfony's profiler, a development only debug UI, renders source-code excerpts on several pages using Twig's custom fileexcerpt filter. This filter renders PHP files via highlightstring() (which escapes HTML), but renders non-PHP files by splitting on \n and interpolating each line directly into <code>{$line}</code> with no escaping.
An attacker who can write arbitrary bytes into any file under the project root (including e.g. var/log/dev.log), achieves stored XSS against any developer who later opens that file in the profiler.
Resolution
The fileexcerpt filter now properly escapes each line of non-PHP files using htmlspecialchars() before concatenating them.
The patch for this issue is available here for branch 6.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
Other sources
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler fileexcerpt Twig filter escapes PHP files through highlightstring() but interpolates lines from non-PHP files directly into <code> elements, allowing stored XSS against a developer who opens an attacker-written file such as var/log/dev.log in the profiler. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/web-profiler-bundleto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/web-profiler-bundleto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/twig-bridgeto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
Symfony profiler (Twig file_excerpt filter)to a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
Symfony profiler (Twig file_excerpt filter)to a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
Symfony profiler (Twig file_excerpt filter)to a version that resolves this vulnerability.Fixed in 8.0.12 - Compensating control
Assume the Symfony WebProfiler code excerpt area is a development-only UI and prevent untrusted users from writing arbitrary bytes into any file under the project root (since this profiler renders excerpts of files like var/log/dev.log, which can enable stored XSS when opened).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45072?
CVE-2026-45072 has a risk rating of 30.
How do I fix CVE-2026-45072?
To fix CVE-2026-45072, update to the latest patched version of the Symfony components affected.
What types of files are vulnerable in CVE-2026-45072?
CVE-2026-45072 affects the rendering of non-PHP files using Twig's `file_excerpt` filter.
What vulnerability type is CVE-2026-45072 classified under?
CVE-2026-45072 is classified under Cross-Site Scripting (XSS) vulnerabilities.
Which Symfony packages are impacted by CVE-2026-45072?
The impacted Symfony packages include composer/symfony/symfony, composer/symfony/web-profiler-bundle, and composer/symfony/twig-bridge.