https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T17:55:56.714355+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-337986 EUVD-2026-337986 2026-10-09T17:55:56.763762+00:00 EUVD-2026-337986 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45071 fkie_cve-2026-45071 2026-10-09T17:55:56.763801+00:00

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

 https://cve.radiocsirt.org/vuln/ghsa-x6g4-fwcc-jj8w GHSA-x6g4-fwcc-jj8w — Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true 2026-10-09T17:55:56.763836+00:00

Affected: Packagist: symfony/dom-crawler, Packagist: symfony/symfony

### Description

`symfony/dom-crawler` provides the `Crawler` class for navigating HTML/XML documents with CSS/XPath selectors; `symfony/browser-kit`'s `HttpBrowser` uses it to parse fetched pages.

`Crawler::addXmlContent()` sets `DOMDocument::$validateOnParse = true` before calling `loadXML()`. Setting `validateOnParse` re-enables libxml's DTD subset processing, including external entity resolution, even though `LIBXML_NONET` is passed. `LIBXML_NONET` blocks **network** fetches but not `file://` entities. An attacker-supplied XML document with a `SYSTEM "file:///etc/passwd"` entity is therefore expanded.

### Resolution

The `Crawler::addXmlContent` method does not set the `validateOnParse` flag anymore.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/eea5fd7488cbdc241da4ce242344b7d9a3ecdf3d) for branch 5.4.

### Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45071 UBUNTU-CVE-2026-45071 2026-10-09T17:55:56.763878+00:00

Affected: Ubuntu:16.04:LTS: symfony, Ubuntu:Pro:18.04:LTS: symfony, Ubuntu:Pro:20.04:LTS: symfony, Ubuntu:Pro:22.04:LTS: symfony, Ubuntu:Pro:24.04:LTS: symfony, Ubuntu:25.10: symfony, Ubuntu:26.04:LTS: symfony

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.