CVE-2026-45072

Katalog CVE

CVSS 5.4 · Medium EPSS 0,31%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada sensiolabs symfony. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler file_excerpt Twig filter escapes PHP files through highlight_string() but interpolates lines from non-PHP files directly into <code> elements, allowing stored XSS against a developer who opens an attacker-written file such as var/log/dev.log in the profiler. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

16 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp patch · advisory vendor
• https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb patch
• https://github.com/symfony/symfony/releases/tag/v6.4.40 release notes
• https://github.com/symfony/symfony/releases/tag/v7.4.12 release notes
• https://github.com/symfony/symfony/releases/tag/v8.0.12 release notes