Dom Crawler
Approved changes feed: RSS · Atom
cpe:2.3:a:symfony:dom-crawler:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Symfony (88011d02-04e0-53e8-bc79-472f99951c29) |
|---|---|
| Product | Dom Crawler (5e534cbc-8e97-5fbc-ad09-edceb8c80839) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-45071 |
vulnerable | 2026-07-29 00:52:15.054459 |
Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Published: 2026-07-14T18:58:15.162Z
Updated: 2026-07-15T14:21:08.891Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.