CyberRota Analysis
AI-GeneratedThe Symfony PHP framework versions 6.4.24 to 6.4.40, 7.4.12, and 8.0.12 are vulnerable to stored cross-site scripting (XSS) attacks due to improper handling of non-PHP files in the development profiler. This vulnerability allows an attacker to craft a malicious file that, when opened by a developer, can execute arbitrary scripts within their browser session. Developers using the affected Symfony versions should prioritize upgrading to the patched releases to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler file_excerpt Twig filter escapes PHP files through highlight_string() but interpolates lines from non-PHP files directly into <code> elements, allowing stored XSS against a developer who opens an attacker-written file such as var/log/dev.log in the profiler. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Related CVEs
Other vulnerabilities affecting the same vendor(s)