XML External Entity Injection in Symfony Config Component

CVE-2026-123824

What is CVE-2026-123824?

The Symfony Config component's XmlUtils::parse() method allows XML External Entity (XXE) injection due to improper handling of DTD validation. This flaw enables an attacker to probe local file existence and potentially exfiltrate file contents through crafted XML documents. Specifically, even though documents with a doctype are eventually rejected, the validation process inadvertently allows access to local file content, which can lead to denial-of-service conditions. Furthermore, applications that utilize untrusted XML inputs are particularly vulnerable, as the affected components may process configuration files and localized resources without sufficient validation.

References