CVE-2026-45071

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

• CWE-611

• https://github.com/symfony/symfony/commit/eea5fd7488cbdc241da4ce242344b7d9a3ecdf3dPatch
• https://github.com/symfony/symfony/releases/tag/v5.4.52Product, Release Notes
• https://github.com/symfony/symfony/releases/tag/v6.4.40Product, Release Notes
• https://github.com/symfony/symfony/releases/tag/v7.4.12Product, Release Notes
• https://github.com/symfony/symfony/releases/tag/v8.0.12Product, Release Notes
• https://github.com/symfony/symfony/security/advisories/GHSA-x6g4-fwcc-jj8wPatch, Vendor Advisory

Published

Jul 14, 2026

Last Modified

Jul 15, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45066Symfony is a PHP framework for web and console applications …6.1
• CVE-2026-45067### Description `Symfony\Component\Mime\Address` is the val…6.3
• CVE-2026-45068Symfony is a PHP framework for web and console applications …7.5
• CVE-2026-45069Symfony is a PHP framework for web and console applications …9.1
• CVE-2026-4507A vulnerability was determined in Mindinventory MindSQL up t…6.3
• CVE-2026-45070Symfony is a PHP framework for web and console applications …6.5
• CVE-2026-45072Symfony is a PHP framework for web and console applications …5.4
• CVE-2026-45073Symfony is a PHP framework for web and console applications …7.3
• CVE-2026-45074Symfony is a PHP framework for web and console applications …8.1
• CVE-2026-45075Symfony is a PHP framework for web and console applications …8.2
• CVE-2026-45076Synapse is an open source Matrix homeserver implementation. …2.7
• CVE-2026-45077Symfony is a PHP framework for web and console applications …8.6