CVE-2026-55878

Name of the Vulnerable Software and Affected Versions Symfony UX versions 2.32.0 through 2.36.0 Symfony UX versions 3.0.0 through 3.1.9

Description The ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map. Due to improper validation in Path::isRelative(), which allows paths containing .. segments, a crafted or compromised kit can escape the intended directory. This allows an attacker to write controlled content to arbitrary locations on a developer's machine or CI runner, potentially overwriting files like controllers, git hooks, or .env to achieve code execution. Additionally, the source side of the copy operation is affected, enabling the reading of local files outside the recipe directory.

Recommendations Update Symfony UX to version 2.36.1 or later. Update Symfony UX to version 3.2.0 or later.