CVE-2026-45072

Summary

Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering

Severity

low

Also known as

GHSA-hmr5-2xcr-v8pp#symfony/symfony, GHSA-hmr5-2xcr-v8pp#symfony/twig-bridge, GHSA-hmr5-2xcr-v8pp#symfony/web-profiler-bundle

Published

2026-05-27

References

• https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp
• https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45072.yaml

Related advisories

• GHSA-mmcv-fvq8-r9x3 — critical · Packagist/symfony/symfony
• CVE-2026-48489 — high · Packagist/symfony/symfony
• CVE-2026-45077 — high · Packagist/symfony/symfony
• CVE-2026-45067 — high · Packagist/symfony/symfony
• CVE-2026-45063 — high · Packagist/symfony/symfony
• CVE-2025-64500 — high · Packagist/symfony/symfony
• CVE-2024-51736 — high · Packagist/symfony/symfony
• CVE-2014-6072 — high · Packagist/symfony/symfony

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity