Ghostwire

CVE-2026-45072: Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering

LOW CVSS 2.5 Exploit Available 5 PoC

Published: May 27, 2026 | Last Modified: May 27, 2026

Description

Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering

Ghostwire Analysis — What This Means Practically

5 proof-of-concept exploits available on GitHub. Public exploit code lowers the barrier for both researchers and attackers.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Proof-of-Concept Exploits (5)

symfony/symfony
symfony/symfony
FriendsOfPHP/security-advisories
FriendsOfPHP/security-advisories
FriendsOfPHP/security-advisories

References

github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp
github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb
github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026
github.com/FriendsOfPHP/security-advisories/blob/master/symfony/twig-bridge/CVE-
github.com/FriendsOfPHP/security-advisories/blob/master/symfony/web-profiler-bun
symfony.com/cve-2026-45072
github.com/advisories/GHSA-hmr5-2xcr-v8pp
www.tenable.com/cve/CVE-2026-45072
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-45072