CVE-2026-45072

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler file_excerpt Twig filter escapes PHP files through highlight_string() but interpolates lines from non-PHP files directly into <code> elements, allowing stored XSS against a developer who opens an attacker-written file such as var/log/dev.log in the profiler. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

• CWE-79

• https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdbPatch
• https://github.com/symfony/symfony/releases/tag/v6.4.40Release Notes
• https://github.com/symfony/symfony/releases/tag/v7.4.12Release Notes
• https://github.com/symfony/symfony/releases/tag/v8.0.12Release Notes
• https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8ppPatch, Vendor Advisory

Published

Jul 14, 2026

Last Modified

Jul 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45067### Description `Symfony\Component\Mime\Address` is the val…6.3
• CVE-2026-45068Symfony is a PHP framework for web and console applications …7.5
• CVE-2026-45069Symfony is a PHP framework for web and console applications …9.1
• CVE-2026-4507A vulnerability was determined in Mindinventory MindSQL up t…6.3
• CVE-2026-45070Symfony is a PHP framework for web and console applications …6.5
• CVE-2026-45071Symfony is a PHP framework for web and console applications …7.5
• CVE-2026-45073Symfony is a PHP framework for web and console applications …7.3
• CVE-2026-45074Symfony is a PHP framework for web and console applications …8.1
• CVE-2026-45075Symfony is a PHP framework for web and console applications …8.2
• CVE-2026-45076Synapse is an open source Matrix homeserver implementation. …2.7
• CVE-2026-45077Symfony is a PHP framework for web and console applications …8.6
• CVE-2026-45078Synapse is an open source Matrix homeserver implementation. …5.5