CVE-2026-123824

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.56 Symfony versions 6.x prior to 6.4.50 Symfony versions 7.x prior to 7.4.23 Symfony versions 8.x prior to 8.1.11

Description The Symfony Config component is susceptible to XML External Entity (XXE) injection. This occurs because the XmlUtils::parse() function enables DTD validation by setting $dom->validateOnParse = true before calling loadXML(), and only rejects documents with a doctype afterward. Consequently, libxml resolves external entities during the loading process. While LIBXML NONET blocks http:// requests, it does not block file:// requests, allowing a remote attacker to supply a crafted XML document to determine if local files exist or cause a denial of service by pointing to large or slow files. Additionally, if a network-capable stream wrapper like s3:// is registered, a parameter entity could be used to exfiltrate local file content to an external server. Applications are affected when untrusted XML is passed directly to the XmlUtils::parse() function.

Recommendations Update Symfony to version 5.4.56 or later. Update Symfony 6.x to version 6.4.50 or later. Update Symfony 7.x to version 7.4.23 or later. Update Symfony 8.x to version 8.1.11 or later. As a temporary mitigation, avoid passing untrusted XML directly to the XmlUtils::parse() function.