Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true

Summary

CVE	CVE-2026-123824
State	PUBLISHED
Assigner	Checkmarx
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-11-06 18:18:05 UTC
Updated	2026-11-06 18:18:05 UTC
Description	The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allowing XML external entity (XXE) injection in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. A remote attacker who can supply XML to this method can determine whether local files exist, cause a denial of service, and, in some configurations, exfiltrate local file content via a crafted XML document whose doctype declares an external file:// entity. XmlUtils::parse() sets $dom->validateOnParse = true before calling loadXML() and only rejects documents carrying a doctype afterwards. Enabling DTD validation makes libxml resolve external entities during loadXML(), and LIBXML_NONET blocks http:// but not file://, so a file:// entity is read from disk before the doctype rejection runs. The content of the file is not returned to the caller, but the distinct libxml error for a missing path reveals whether a file exists, and an entity pointing at a large or slow file causes a denial of service. If the application registers a network-capable stream wrapper such as s3://, a parameter entity can also send the content of a local file to an external server. This is the same issue as CVE-2026-45071, which was fixed in the DomCrawler component but not in Config. Applications are affected if they pass untrusted XML to XmlUtils::parse() directly. The Symfony components that call it process developer-provided or operator-configured sources, such as configuration files and the XLIFF documents fetched by the translation providers.

Risk And Classification

Primary CVSS: v4.0 2.3 LOW from 596c5446-0ce5-4ba2-aa66-48b3b757a647

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Problem Types: CWE-611 | CWE-611 CWE-611 Improper Restriction of XML External Entity Reference

Version	Source	Type	Score	Severity	Vector
4.0	596c5446-0ce5-4ba2-aa66-48b3b757a647	Secondary	2.3	LOW	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/C...`
4.0	CNA	CVSS	2.3	LOW	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N`

CVSS v4.0 Breakdown

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

Low

User Interaction

None

Confidentiality

Low

Integrity

Low

Availability

Low

Sub Conf.

None

Sub Integrity

None

Sub Availability

None

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Sensiolabs	Symfony	affected 5.4.56 git	Not specified
CNA	Sensiolabs	Symfony	affected 6.0.0 6.4.50 git	Not specified
CNA	Sensiolabs	Symfony	affected 7.0.0 7.4.23 git	Not specified
CNA	Sensiolabs	Symfony	affected 8.0.0 8.1.11 git	Not specified

References

Reference	Source	Link	Tags
github.com/symfony/symfony/security/advisories/GHSA-5jff-8h8q-r5qx	596c5446-0ce5-4ba2-aa66-48b3b757a647	github.com
github.com/symfony/symfony/commit/334ef21a6039355c05b123e7df60699be0e28da3	596c5446-0ce5-4ba2-aa66-48b3b757a647	github.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Prithiv Kumaravel from ProjectDiscovery (en)

CNA: Björn Meyer from Shopware AG (en)

CNA: Nicolas Grekas (en)

There are currently no legacy QID mappings associated with this CVE.