CVE-2026-45071: Sensiolabs Symfony XXE Vulnerability

CVE-2026-45071 Overview

CVE-2026-45071 is an XML External Entity (XXE) vulnerability in the Symfony PHP framework's DomCrawler component. The Crawler::addXmlContent() method set DOMDocument::$validateOnParse = true before calling loadXML(), which re-enabled external entity resolution. Attackers supplying crafted XML can expand file:// entities and read local files on the server. The flaw affects Symfony versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12. It is tracked under CWE-611: Improper Restriction of XML External Entity Reference.

Critical Impact
Remote, unauthenticated attackers can exfiltrate sensitive local files from Symfony applications that parse untrusted XML through Crawler::addXmlContent().

Affected Products

Symfony versions prior to 5.4.52
Symfony versions prior to 6.4.40 and 7.4.12
Symfony versions prior to 8.0.12

Discovery Timeline

2026-07-14 - CVE-2026-45071 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45071

Vulnerability Analysis

The vulnerability resides in src/Symfony/Component/DomCrawler/Crawler.php inside the addXmlContent() method. Symfony instantiates a DOMDocument and explicitly sets validateOnParse = true prior to invoking loadXML(). Enabling DTD validation causes libxml to resolve external entities declared in the incoming XML, even when LIBXML_NONET and other hardening flags are passed. An attacker who can submit XML that eventually reaches Crawler::addXmlContent() can declare an external entity pointing to a local file and cause its contents to be embedded in the parsed document. Applications that echo, log, or otherwise return the parsed content leak the retrieved data back to the attacker.

Root Cause

The root cause is the unnecessary activation of DTD validation on a parser that processes untrusted input. Setting $dom->validateOnParse = true overrides the safer libxml defaults and instructs the parser to resolve <!ENTITY> declarations referencing external resources. Combined with loadXML(), this produces a classic XXE primitive [CWE-611].

Attack Vector

Exploitation requires only that attacker-controlled XML reach Crawler::addXmlContent(). Common paths include XML request bodies parsed by controllers, third-party feeds imported by scheduled jobs, or file uploads processed by services relying on DomCrawler. The attacker submits an XML document containing an external entity such as <!ENTITY xxe SYSTEM "file:///etc/passwd"> and references it inside an element. When the response reflects or logs the parsed value, the file contents are disclosed.

php

         }
 
         $dom = new \DOMDocument('1.0', $charset);
-        $dom->validateOnParse = true;
 
         if ('' !== trim($content)) {
             @$dom->loadXML($content, $options);

Source: Symfony security patch commit eea5fd7

The patch removes the validateOnParse assignment so libxml no longer resolves external entities during parsing.

Detection Methods for CVE-2026-45071

Indicators of Compromise

Inbound HTTP requests carrying XML payloads that include <!DOCTYPE> declarations or <!ENTITY ... SYSTEM "file://..."> references.
Web server or application logs containing fragments of local files such as /etc/passwd, .env, or configuration files in HTTP responses.
PHP-FPM or worker processes issuing unexpected file://, php://, or http:// reads triggered by XML parsing routines.

Detection Strategies

Inspect application traffic at the WAF or reverse proxy for XML bodies containing external entity declarations before they reach Symfony controllers.
Perform code review or grep for calls to Crawler::addXmlContent( across the codebase to enumerate exposed sinks.
Use software composition analysis to flag Symfony installations at versions below the patched releases listed in the GHSA-x6g4-fwcc-jj8w advisory.

Monitoring Recommendations

Alert on PHP processes reading sensitive files such as /etc/passwd, /proc/self/environ, or application secrets outside of expected code paths.
Log and review libxml_get_errors() output for entity resolution warnings in production.
Monitor egress connections from application servers for unexpected outbound requests originating from XML parsing operations.

How to Mitigate CVE-2026-45071

Immediate Actions Required

Upgrade Symfony to 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on the branch in use.
Audit application code for direct or indirect callers of Crawler::addXmlContent() that process untrusted input.
Restrict network egress from PHP workers to limit out-of-band XXE exfiltration attempts while patching is scheduled.

Patch Information

The fix is applied in commit eea5fd7488cbdc241da4ce242344b7d9a3ecdf3d and shipped in Symfony v5.4.52, v6.4.40, v7.4.12, and v8.0.12. Full details are documented in the GHSA-x6g4-fwcc-jj8w advisory.

Workarounds

Wrap calls to addXmlContent() with a custom loader that disables DTD loading using libxml_set_external_entity_loader() returning null.
Pre-validate incoming XML to reject documents containing <!DOCTYPE or <!ENTITY declarations before passing them to Symfony.
Deploy WAF rules that block XML payloads containing external entity references until the framework upgrade is completed.

bash

# Update Symfony DomCrawler to a patched release using Composer
composer require symfony/dom-crawler:^7.4.12
composer update symfony/dom-crawler