Symfony
30 CVEs across 26 Symfony products. Browse Symfony vulnerabilities, severities, and proof-of-concept exploits.
Symfony products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-49216 | Medium | 5.4 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response i… |
CVE-2026-49215 | Medium | 5.4 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventListener\LiveComponentSubscriber::isLiveCom… |
CVE-2026-49212 | High | 7.5 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covere… |
CVE-2026-49211 | High | 7.5 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() build… |
CVE-2026-49210 | Medium | 6.1 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml()… |
CVE-2026-49209 | Medium | 6.5 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iter… |
CVE-2026-49208 | Medium | 5.3 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and no explicit format is… |
CVE-2026-49981 | High | 8.2 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is con… |
CVE-2026-48808 | High | 7.5 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to… |
CVE-2026-48807 | Critical | 9.1 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters… |
CVE-2026-48806 | Critical | 9.1 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke _… |
CVE-2026-48805 | Critical | 9.1 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreEx… |
CVE-2026-47732 | Medium | 6.5 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting S… |
CVE-2026-47730 | Medium | 5.4 | 2026-07-14 | Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML ou… |
CVE-2026-46640 | High | 8.8 | 2026-07-14 | Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlle… |
CVE-2026-46639 | Medium | 6.5 | 2026-07-14 | Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compiles CoreExtension::getAttribute() with the sandbox argument… |
CVE-2026-46638 | High | 8.1 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without… |
CVE-2026-46637 | Medium | 5.4 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], ca… |
CVE-2026-46635 | Medium | 4.3 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties wit… |
CVE-2026-46634 | Critical | 9.8 | 2026-07-14 | Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> n… |
CVE-2026-46633 | Critical | 9.8 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed insi… |
CVE-2026-46629 | Medium | 6.5 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-cont… |
CVE-2026-46628 | Medium | 5.4 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacke… |
CVE-2026-46627 | Medium | 6.5 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under t… |
CVE-2026-46644 | | 2026-07-14 | Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn acc… | |
CVE-2026-48784 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::do… |
CVE-2026-48761 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSani… |
CVE-2026-48760 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::pa… |
CVE-2026-48747 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSi… |
CVE-2026-48736 | High | 8.6 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNe… |
CVE-2026-48489 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthentic… |
CVE-2026-47212 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doP… |
CVE-2026-45071 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlC… |
CVE-2026-45068 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTranspor… |
CVE-2026-47767 | Critical | 9.8 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE… |
CVE-2026-45755 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse()… |
CVE-2026-45754 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridg… |
CVE-2026-45753 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttribu… |
CVE-2026-45305 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Componen… |
CVE-2026-45304 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Componen… |
CVE-2026-45133 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser… |
CVE-2026-45075 | High | 8.2 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsS… |
CVE-2026-45073 | High | 7.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doCl… |
CVE-2026-45072 | Medium | 5.4 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development… |
CVE-2026-45070 | Medium | 6.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Componen… |
CVE-2026-45069 | Critical | 9.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verify… |
CVE-2026-45064 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitiz… |
CVE-2026-45063 | Critical | 9.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticato… |
CVE-2026-45756 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath compon… |
CVE-2026-45077 | High | 8.6 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log l… |
CVE-2026-45074 | High | 8.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CA… |
CVE-2026-45067 | | 2026-07-14 | ### Description `Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is… | |
CVE-2026-45066 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSaniti… |
CVE-2026-45065 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator val… |
CVE-2026-55878 | High | 7.8 | 2026-07-08 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a r… |
CVE-2026-55877 | Medium | 6.1 | 2026-07-08 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux_icon() Twig function is marked is_safe=['html']… |
CVE-2026-24425 | High | 8.8 | 2026-05-20 | Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template ren… |
CVE-2026-24739 | Medium | 6.3 | 2026-01-28 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.51, 6.4.33, 7.3.11, 7.4.5, and 8.0.5, t… |
CVE-2025-64500 | High | 7.3 | 2025-11-12 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented… |
CVE-2025-47946 | Medium | 6.1 | 2025-05-19 | Symfony UX is an initiative and set of libraries to integrate JavaScript tools into applications. Prior to version 2.25.1, rendering `{{ attributes }}` or usin… |
CVE-2024-51996 | High | 7.5 | 2024-11-13 | Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony do… |
CVE-2024-51736 | Unrated | | 2024-11-06 | Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is lo… |
CVE-2024-50345 | Low | 3.1 | 2024-11-06 | symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does… |
CVE-2024-50343 | Low | 3.1 | 2024-11-06 | symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a r… |
CVE-2024-50342 | Low | 3.1 | 2024-11-06 | symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When us… |
CVE-2024-50341 | Low | 3.1 | 2024-11-06 | symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack fra… |
CVE-2024-50340 | High | 7.3 | 2024-11-06 | symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php direc… |
CVE-2024-45411 | High | 8.5 | 2024-09-09 | Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sa… |
CVE-2023-46735 | Medium | 6.1 | 2023-11-10 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the err… |
CVE-2023-46734 | Medium | 6.1 | 2023-11-10 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to ver… |
CVE-2023-46733 | Medium | 6.5 | 2023-11-10 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5… |
CVE-2023-41336 | Medium | 6.5 | 2023-09-11 | ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an… |
CVE-2022-24895 | Medium | 6.3 | 2023-02-03 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the… |
CVE-2022-24894 | Medium | 5.9 | 2023-02-03 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It ca… |
CVE-2022-39261 | High | 7.5 | 2022-09-28 | Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader lo… |
CVE-2022-23614 | High | 8.8 | 2022-02-04 | Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being… |
CVE-2022-23601 | High | 8.1 | 2022-02-01 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechani… |
CVE-2021-41270 | Medium | 6.5 | 2021-11-24 | Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PH… |
CVE-2021-41268 | Medium | 6.5 | 2021-11-24 | Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rew… |
CVE-2021-41267 | Medium | 6.5 | 2021-11-24 | Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers th… |
CVE-2021-32693 | Medium | 6.8 | 2021-06-17 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symf… |
CVE-2021-21424 | Medium | 5.3 | 2021-05-13 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant… |
CVE-2020-15094 | High | 8.0 | 2020-09-02 | In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests… |
CVE-2020-5275 | High | 7.6 | 2020-03-30 | In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as so… |
CVE-2020-5274 | Medium | 4.6 | 2020-03-30 | In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addit… |
CVE-2020-5255 | Low | 2.6 | 2020-03-30 | In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format… |
CVE-2019-9942 | Low | 3.7 | 2019-03-23 | A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() m… |
CVE-2018-13818 | Critical | 9.8 | 2018-07-10 | Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web a… |
CVE-2015-7809 | | 2015-11-06 | The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via t… | |
CVE-2001-1537 | High | 7.5 | 2001-12-31 | The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow a… |