Cloudanix VulnDB

CVE-2026-45072

Medium · 4.6

Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering

CVSS

4.6

EPSS

0.3%

Published

May 27, 2026

CISA due date

—

The record

Symfony's profiler, a development only debug UI, renders source-code excerpts on several pages using Twig's custom `file_excerpt` filter. This filter renders PHP files via `highlight_string()` (which escapes HTML), but renders **non-PHP files** by splitting on `\n` and interpolating each line directly into `<code>{$line}</code>` with no escaping. An attacker who can write arbitrary bytes into any file under the project root (including e.g. `var/log/dev.log`), achieves **stored XSS** against any developer who later opens that file in the profiler.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities