{"id":"CVE-2026-123824","aliases":[],"cve":{"records":[{"id":"CVE-2026-123824","source":"Checkmarx","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T15:59:52.152Z","published":"2026-11-06T17:19:24.750Z","modified":"2026-11-06T20:29:12.981Z"}],"publishers":[{"name":"Checkmarx","role":"CNA","organizationId":"596c5446-0ce5-4ba2-aa66-48b3b757a647","modified":"2026-11-06T17:19:24.750Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-06T20:29:12.981Z"}],"references":[{"url":"https://github.com/symfony/symfony/security/advisories/GHSA-5jff-8h8q-r5qx","tags":["third-party-advisory"],"source":"Checkmarx"},{"url":"https://github.com/symfony/symfony/commit/334ef21a6039355c05b123e7df60699be0e28da3","tags":["patch"],"source":"Checkmarx"}],"weaknesses":[{"id":"CWE-611","description":"CWE-611 Improper Restriction of XML External Entity Reference","source":"Checkmarx"}],"applicability":[{"source":"Checkmarx","statements":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"5.4.56"},{"vulnerable":true,"criteria":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.4.50"},{"vulnerable":true,"criteria":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.4.23"},{"vulnerable":true,"criteria":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.1.11"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-06T20:28:48.074549Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true","titleSource":"Checkmarx","descriptionSource":"Checkmarx","description":"The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allowing XML external entity (XXE) injection in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. A remote attacker who can supply XML to this method can determine whether local files exist, cause a denial of service, and, in some configurations, exfiltrate local file content via a crafted XML document whose doctype declares an external file:// entity.\nXmlUtils::parse() sets $dom->validateOnParse = true before calling loadXML() and only rejects documents carrying a doctype afterwards. Enabling DTD validation makes libxml resolve external entities during loadXML(), and LIBXML_NONET blocks http:// but not file://, so a file:// entity is read from disk before the doctype rejection runs. The content of the file is not returned to the caller, but the distinct libxml error for a missing path reveals whether a file exists, and an entity pointing at a large or slow file causes a denial of service. If the application registers a network-capable stream wrapper such as s3://, a parameter entity can also send the content of a local file to an external server. This is the same issue as CVE-2026-45071, which was fixed in the DomCrawler component but not in Config.\n\nApplications are affected if they pass untrusted XML to XmlUtils::parse() directly. The Symfony components that call it process developer-provided or operator-configured sources, such as configuration files and the XLIFF documents fetched by the translation providers.","score":6.3,"severity":"medium","published":"2026-11-06T17:19:24.750Z","modified":"2026-11-06T20:29:12.981Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"sensiolabs","name":"symfony","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"5.4.56","versionType":"git"},{"version":"6.0.0","status":"affected","lessThan":"6.4.50","versionType":"git"},{"version":"7.0.0","status":"affected","lessThan":"7.4.23","versionType":"git"},{"version":"8.0.0","status":"affected","lessThan":"8.1.11","versionType":"git"}],"defaultStatus":"unaffected","cpes":[],"source":"Checkmarx","url":"https://www.cve.org/CVERecord?id=CVE-2026-123824"}],"remediation":[],"references":["https://github.com/symfony/symfony/security/advisories/GHSA-5jff-8h8q-r5qx","https://github.com/symfony/symfony/commit/334ef21a6039355c05b123e7df60699be0e28da3"],"sources":[{"name":"CVE","id":"CVE-2026-123824","modified":"2026-11-06T20:29:12.981Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123824"}],"assessments":[{"source":"Checkmarx","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","score":2.3},{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3}],"sourceAffected":[],"observedAt":"2026-11-06T20:47:11.299Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:05:34.570Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-06T18:15:33.287Z","attemptedAt":"2026-11-06T18:15:33.287Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-06T18:15:33.246Z","attemptedAt":"2026-11-06T18:15:33.246Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-06T18:15:33.873Z","attemptedAt":"2026-11-06T18:15:33.873Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-06T18:15:33.349Z","attemptedAt":"2026-11-06T18:15:33.349Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-118384","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-118384","modified":"Nov 6, 2026, 5:19:24 PM","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","checkedAt":"2026-11-06T18:15:33.873Z"}],"aiSummary":null}