{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-123824","assignerOrgId":"596c5446-0ce5-4ba2-aa66-48b3b757a647","state":"PUBLISHED","assignerShortName":"Checkmarx","dateReserved":"2026-11-06T15:59:52.152Z","datePublished":"2026-11-06T17:19:24.750Z","dateUpdated":"2026-11-06T20:29:12.981Z"},"containers":{"cna":{"providerMetadata":{"orgId":"596c5446-0ce5-4ba2-aa66-48b3b757a647","shortName":"Checkmarx","dateUpdated":"2026-11-06T17:19:24.750Z"},"title":"Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-611","description":"CWE-611 Improper Restriction of XML External Entity Reference","type":"CWE"}]}],"affected":[{"vendor":"sensiolabs","product":"symfony","collectionURL":"https://packagist.org/packages/symfony/config","packageName":"symfony/config","repo":"https://github.com/symfony/config","modules":["Symfony\\Component\\Config\\Util\\XmlUtils::parse"],"versions":[{"status":"affected","version":"0","lessThan":"5.4.56","versionType":"git"},{"status":"affected","version":"6.0.0","lessThan":"6.4.50","versionType":"git"},{"status":"affected","version":"7.0.0","lessThan":"7.4.23","versionType":"git"},{"status":"affected","version":"8.0.0","lessThan":"8.1.11","versionType":"git"}],"defaultStatus":"unaffected"}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"5.4.56"},{"vulnerable":true,"criteria":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.4.50"},{"vulnerable":true,"criteria":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.4.23"},{"vulnerable":true,"criteria":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.1.11"}]}]}],"descriptions":[{"lang":"en","value":"The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allowing XML external entity (XXE) injection in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. A remote attacker who can supply XML to this method can determine whether local files exist, cause a denial of service, and, in some configurations, exfiltrate local file content via a crafted XML document whose doctype declares an external file:// entity.\nXmlUtils::parse() sets $dom->validateOnParse = true before calling loadXML() and only rejects documents carrying a doctype afterwards. Enabling DTD validation makes libxml resolve external entities during loadXML(), and LIBXML_NONET blocks http:// but not file://, so a file:// entity is read from disk before the doctype rejection runs. The content of the file is not returned to the caller, but the distinct libxml error for a missing path reveals whether a file exists, and an entity pointing at a large or slow file causes a denial of service. If the application registers a network-capable stream wrapper such as s3://, a parameter entity can also send the content of a local file to an external server. This is the same issue as CVE-2026-45071, which was fixed in the DomCrawler component but not in Config.\n\nApplications are affected if they pass untrusted XML to XmlUtils::parse() directly. The Symfony components that call it process developer-provided or operator-configured sources, such as configuration files and the XLIFF documents fetched by the translation providers.","supportingMedia":[{"type":"text/html","base64":false,"value":"The Symfony Config component&nbsp;<code>XmlUtils::parse()</code>&nbsp;enables DTD validation before rejecting documents that carry a doctype, allowing&nbsp;XML external entity (XXE) injection in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. A remote attacker who can supply XML to this method can determine whether local files exist, cause a denial of service, and, in some configurations, exfiltrate local file content via a crafted XML document whose doctype declares an external&nbsp;<code>file://</code>&nbsp;entity.<br><div><span>XmlUtils::parse()</span>&nbsp;sets&nbsp;<code>$dom-&gt;validateOnParse = true</code>&nbsp;before calling&nbsp;<code>loadXML()</code>&nbsp;and only rejects documents carrying a doctype afterwards. Enabling DTD validation makes libxml resolve external entities during&nbsp;<code>loadXML()</code>, and&nbsp;<code>LIBXML_NONET</code>&nbsp;blocks&nbsp;<code>http://</code>&nbsp;but not&nbsp;<code>file://</code>, so a&nbsp;<code>file://</code>&nbsp;entity is read from disk before the doctype rejection runs. The content of the file is not returned to the caller, but the distinct libxml error for a missing path reveals whether a file exists, and an entity pointing at a large or slow file causes a denial of service. If the application registers a network-capable stream wrapper such as&nbsp;<code>s3://</code>, a parameter entity can also send the content of a local file to an external server.&nbsp;This is the same issue as CVE-2026-45071, which was fixed in the&nbsp;<code>DomCrawler</code>&nbsp;component but not in&nbsp;<code>Config</code>.</div><div>Applications are affected if they pass untrusted XML to&nbsp;<code>XmlUtils::parse()</code>&nbsp;directly. The Symfony components that call it process developer-provided or operator-configured sources, such as configuration files and the XLIFF documents fetched by the translation providers.</div>"}]}],"references":[{"url":"https://github.com/symfony/symfony/security/advisories/GHSA-5jff-8h8q-r5qx","tags":["third-party-advisory"]},{"url":"https://github.com/symfony/symfony/commit/334ef21a6039355c05b123e7df60699be0e28da3","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"LOW","baseScore":2.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}}],"credits":[{"lang":"en","value":"Prithiv Kumaravel from ProjectDiscovery","type":"reporter"},{"lang":"en","value":"Björn Meyer from Shopware AG","type":"reporter"},{"lang":"en","value":"Nicolas Grekas","type":"remediation developer"}],"source":{"advisory":"GHSA-5jff-8h8q-r5qx","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-11-06T20:28:48.074549Z","id":"CVE-2026-123824","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-11-06T20:29:12.981Z"}}]}}