Symfony patches SSRF, XSS, and security bypass flaws
Multiple vulnerabilities in Symfony framework versions 5.4–8.0 enable SSRF, XSS, and security policy bypass; patches available from vendor.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 6 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
The French CERT (CERT-FR) published an advisory disclosing multiple vulnerabilities affecting the Symfony web application framework across versions 5.4.x through 8.0.x. The flaws enable several attack vectors including server-side request forgery (SSRF), cross-site scripting (XSS), and security policy bypass. Six distinct GitHub Security Advisories and CVE identifiers have been assigned to these issues.
Affected versions include Symfony 5.4.x prior to 5.4.53, 6.4.x prior to 6.4.41, 7.0.x prior to 7.4.13, and 8.0.x prior to 8.0.13. The vendor has released patches addressing all identified vulnerabilities. Organizations running Symfony-based applications should prioritize updates to the latest patched releases within their respective version streams.
The advisory references six separate security bulletins published by Symfony on May 27, 2026, each detailing specific vulnerability conditions and remediation guidance. Given Symfony's widespread use in enterprise web applications, these vulnerabilities present significant risk to organisations that have not yet applied the available patches.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0653
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs