CVE-2026-45071

Analyzed Analyzed - Analysis Complete

XML External Entity Injection in Symfony PHP Framework

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-45071

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 7.0.0 (inc) to 7.4.12 (exc)
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.12 (exc)
sensiolabs	symfony	to 5.4.52 (exc)
sensiolabs	symfony	From 6.0.0 (inc) to 6.4.40 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

This vulnerability is an XML External Entity (XXE) flaw in Symfony's DomCrawler component. The Crawler::addXmlContent() method previously enabled external entity resolution by setting DOMDocument::$validateOnParse to true before loading XML. This allowed attacker-supplied XML to expand file:// entities, potentially accessing local files.

Detection Guidance

To detect this vulnerability, check if your Symfony application uses versions prior to 5.4.52, 6.4.40, 7.4.12, or 8.0.12. Inspect code for usage of Crawler::addXmlContent() with XML containing external entities. Use commands like 'composer show symfony/symfony' to verify versions. Check application logs for unusual file access patterns that may indicate XXE attempts.

Impact Analysis

An attacker could exploit this to read sensitive files on the server running the vulnerable Symfony application. This includes configuration files, credentials, or other confidential data accessible by the web server process.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance violations if exploited.

Mitigation Strategies

Immediately update Symfony to versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 or later. If updating is not possible, disable XML external entity processing in your application's XML parser configuration. Review and sanitize all XML inputs to prevent external entity resolution. Monitor for suspicious file access attempts.

Hi! I’m here to help you understand CVE-2026-45071. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70