CVE-2026-45072: Sensiolabs Symfony XSS Vulnerability

CVE-2026-45072 Overview

CVE-2026-45072 is a stored cross-site scripting (XSS) vulnerability in the Symfony PHP framework's development profiler. The flaw resides in the file_excerpt Twig filter inside CodeExtension, which escapes PHP files through highlight_string() but interpolates lines from non-PHP files directly into <code> elements. An attacker who can write to a file the developer later opens in the profiler, such as var/log/dev.log, can trigger script execution in the developer's browser. The issue affects Symfony 6.4.24 through 6.4.39, 7.4.x prior to 7.4.12, and 8.0.x prior to 8.0.12. It is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

Critical Impact
Attackers who can influence log or non-PHP file contents can execute arbitrary JavaScript in a developer's browser session when the file is viewed through the Symfony profiler.

Affected Products

Symfony 6.4.24 through 6.4.39
Symfony 7.4.x prior to 7.4.12
Symfony 8.0.x prior to 8.0.12

Discovery Timeline

2026-07-14 - CVE-2026-45072 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-45072

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw [CWE-79] in Symfony's TwigBridge component. The CodeExtension::fileExcerpt() method renders a snippet of a source file inside the web profiler to help developers locate code referenced in stack traces or log entries. The method branches on whether the file contains a PHP opening tag. For PHP files, it invokes highlight_string(), which produces HTML-escaped, syntax-colored output. For non-PHP files, the original implementation split the raw file contents on newlines and injected them directly into <code> elements without any HTML encoding.

An attacker who can write content to a file that a developer subsequently views through the profiler, such as an application log at var/log/dev.log, can embed HTML and JavaScript that executes in the developer's browser. Exploitation requires the profiler to be enabled, which is normal in development environments but should never be exposed in production.

Root Cause

The root cause is missing output encoding on a code path that assumed non-PHP file contents were safe to render as HTML. The highlight_string() function used for PHP files performs implicit escaping, which masked the absence of explicit sanitization for the alternate branch handling arbitrary text files.

Attack Vector

Exploitation requires an attacker to control content written to a file readable by the Symfony application, and a developer to open that file through the profiler UI. Common vectors include injecting crafted strings into request parameters, headers, or user-agent fields that are subsequently logged to var/log/dev.log or similar files. When the developer clicks a stack trace link that opens the file excerpt, the embedded script executes in the profiler origin.

php

         $contents = file_get_contents($file);
 
         if (!str_contains($contents, '<?php') && !str_contains($contents, '<?=')) {
-            $lines = explode("\n", $contents);
+            $lines = explode("\n", htmlspecialchars($contents, \ENT_QUOTES | \ENT_SUBSTITUTE, $this->charset));
 
             if (0 > $srcContext) {
                 $srcContext = \count($lines);

Source: Symfony commit 863aa81c. The patch wraps file contents with htmlspecialchars() using ENT_QUOTES | ENT_SUBSTITUTE before splitting lines, ensuring HTML metacharacters are encoded before insertion into the DOM.

Detection Methods for CVE-2026-45072

Indicators of Compromise

Log entries in var/log/dev.log or similar files containing HTML tags such as <script>, <img onerror=, or <svg onload=.
Requests to the Symfony profiler routes (/_profiler, /_wdt) originating from developer workstations shortly after ingesting attacker-controlled input.
Outbound network requests from developer browsers to unknown domains immediately after profiler use.

Detection Strategies

Inventory Symfony deployments and identify installations running versions between 6.4.24 and 6.4.39, 7.4.x below 7.4.12, or 8.0.x below 8.0.12.
Scan application log files for HTML or JavaScript payloads that would be rendered when opened through the profiler.
Review web server access logs for external exposure of /_profiler or /_wdt endpoints, which should never be reachable in production.

Monitoring Recommendations

Alert on any production traffic reaching Symfony profiler paths.
Monitor developer endpoints for unexpected script execution or credential access following profiler sessions.
Track composer dependency updates in CI/CD pipelines to confirm rollout of patched Symfony versions.

How to Mitigate CVE-2026-45072

Immediate Actions Required

Upgrade Symfony to 6.4.40, 7.4.12, or 8.0.12 depending on the branch in use.
Confirm the profiler and web debug toolbar are disabled in any non-development environment.
Restrict network access to development environments so untrusted inputs cannot reach application logs.

Patch Information

The fix is committed in Symfony commit 863aa81c61166f1aa74b7732df316f76113acbdb and shipped in Symfony v6.4.40, v7.4.12, and v8.0.12. Full details are documented in the GitHub Security Advisory GHSA-hmr5-2xcr-v8pp.

Workarounds

Disable the WebProfilerBundle and DebugBundle if upgrading is not immediately feasible.
Sanitize or filter user-controlled input before it is written to log files consumed by the profiler.
Avoid opening untrusted files through the profiler file_excerpt view until the patch is applied.

bash

# Upgrade Symfony via Composer
composer require symfony/twig-bridge:^6.4.40
composer require symfony/twig-bridge:^7.4.12
composer require symfony/twig-bridge:^8.0.12

# Verify installed version
php bin/console --version