symfony/config vulnerabilities

CVEs whose affected-version data names the symfony/config package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-123824Low· 2.3

2d ago

Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true

The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allowing XML external entity (XXE) injection in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.…

▾ Sunlitsensiolabs · symfony/configEPSS 0.27%via CVEORG