Critical: PHP has an open critical advisory
Read the advisory →Craft CMS stack security advisories
The tools a typical Craft CMS app runs on, in one list: PHP, Craft CMS, Yii, Laravel framework, Symfony components, Twig, Doctrine, Guzzle and Composer.
10 advisories affect supported versions.
Tools in the stack
Each has its own page, with its supported branches and a check for your version.
| Tool | Latest release | Status |
|---|---|---|
| PHP php | 8.5.12 | 2 open |
| Craft CMS craftcms/cms | 5.12.1 | No advisories |
| Yii yiisoft/yii2 | 2.0.55 | No advisories |
| Laravel framework laravel/framework | 13.42.0 | No advisories |
| Symfony components symfony/http-kernel | 8.1.11 | 8 open |
| Twig twig/twig | 3.30.0 | No open advisories |
| Doctrine doctrine/orm | 3.7.6 | No advisories |
| Guzzle guzzlehttp/guzzle | 8.3.1 | No open advisories |
| Composer composer/composer | 2.11.2 | No open advisories |
Advisories across the stack
158 advisories, newest first.
-
high CVE-2026-118515 Reviewed
Symfony Serializer: Fake UploadedFile Data Can Point at Any Server File
Lets a client make an app treat any server file as an upload in apps that deserialize request data into UploadedFile properties.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
high CVE-2026-123792 Reviewed
Symfony Yaml: Small Documents Can Tie Up the Parser for Minutes
Lets an attacker keep a PHP worker busy with one small YAML document in apps that parse untrusted YAML, including some #[MapRequestPayload] endpoints.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
high CVE-2026-121623 Reviewed
Symfony Serializer: Data URIs Can Read Any File on the Server
Lets a client read any file PHP can read in apps that deserialize client data into SplFileObject, SplFileInfo or File properties.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
medium CVE-2026-122053 Reviewed
Symfony Serializer: Nested Properties Marked #[Ignore] Can Still Be Set
Lets a client set #[Ignore] properties on nested objects in apps that deserialize input with ObjectNormalizer, such as #[MapRequestPayload].
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56+ 1 older release
-
high CVE-2026-121971 Reviewed
Symfony HttpClient: Scoped Client Can Send Credentials to Other Hosts
Can send a scoped client's token or other credentials to another host when an attacker controls the start of a URL the app requests.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
high Reviewed
Symfony Filesystem: Crafted Paths Can Escape Their Base Directory
Lets an attacker read or write files outside an allowed folder in apps that check user paths with Path, and lets packages write outside assets/vendor.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
low CVE-2026-123119 Reviewed
Symfony HttpClient: DNS Rebinding Lets NoPrivateNetworkHttpClient Probe Ports
Lets an attacker who controls a host's DNS probe internal hosts and ports through repeated NoPrivateNetworkHttpClient requests to that host.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
medium CVE-2026-45070 Reviewed
Symfony Mime: Header Injection Through Mime Parameter Names
Lets an attacker add extra email headers in apps that build a Content-Type or Content-Disposition parameter name from user input.
Update Symfony to
8.1.x 8.1.10 7.4.x 7.4.22 6.4.x 6.4.49 5.4.x 5.4.55 -
critical CVE-2026-109618
RCE via OOM corruption
Update PHP to
8.5.x 8.5.12 8.4.x 8.4.27 8.3.x 8.3.36 8.2.x 8.2.35 -
critical CVE-2026-109619
RCE via stale global state
Update PHP to
8.5.x 8.5.12 8.4.x 8.4.27 8.3.x 8.3.36 8.2.x 8.2.35 -
medium CVE-2026-59944 Reviewed
Composer: Malicious Package Can Change File Permissions Outside Vendor
Lets a malicious dependency make a file outside its own folder readable and runnable by anyone, getting around the earlier GHSA-gjfg-22fp-rrxx fix.
Update Composer to
2.10.x 2.10.3+ 1 older release
-
medium CVE-2026-93682
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-92842
OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
Update PHP to
8.5.x 8.5.10 8.4.x 8.4.25 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91768
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91769
TLS Hostname Verification Falls Back to CN After SAN Mismatch
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91767
Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
low CVE-2025-1218
Various packet overreads in mysqlnd_writeprotocol.c
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91766
Cross-origin credential leak in HTTP stream wrapper redirects
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
high CVE-2026-91765
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2025-14181
Integer overflow to buffer overflow in soap HTTP parsing
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-6103
Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-17545
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
high CVE-2026-84361 Reviewed
Composer: Malicious Package Can Run Commands via a Perforce Source URL
Lets a malicious package run commands during composer install on machines with the p4 client, when it comes from a repository other than Packagist.org.
Update Composer to
2.10.x 2.10.3+ 1 older release
-
high CVE-2026-109413 Reviewed
Symfony Yaml: Deeply Nested Inline YAML Crashes the Process
Lets an attacker crash the PHP process with one YAML document in apps that parse untrusted YAML, including some #[MapRequestPayload] endpoints.
Update Symfony to
8.1.x 8.1.6 7.4.x 7.4.18 6.4.x 6.4.45 5.4.x 5.4.54 -
high CVE-2026-69246 Reviewed
Guzzle: Oddly Written Hosts Can Slip Past Host-Based Checks
Lets an attacker reach hosts an app meant to block, such as loopback, when the app builds Guzzle request URLs from user input and checks the host first.
Update Guzzle to
8.0.x 8.0.1 7.15.x 7.15.2 -
medium CVE-2026-69245 Reviewed
Guzzle: Cookies for Numeric or Escaped Domains Leak to Other Hosts
Can leak cookies set for an IP-style Domain to other hosts in apps that use Guzzle's cookie jar, exposing session ids or tokens.
Update Guzzle to
8.0.x 8.0.1 7.15.x 7.15.2 -
medium CVE-2026-7260
Stack overflow in phar with circular symlinks
Update PHP to
8.5.x 8.5.9 8.4.x 8.4.24 8.3.x 8.3.33 8.2.x 8.2.33 -
high CVE-2026-17544
Out-of-bounds write in bccomp() via crafted operand and scale
Update PHP to
8.5.x 8.5.9 8.4.x 8.4.24 -
high CVE-2026-17543
SQL injection in ext-pgsql via E'...' backslash breakout
Update PHP to
8.5.x 8.5.9 8.4.x 8.4.24 8.3.x 8.3.33 8.2.x 8.2.33 -
medium CVE-2026-59882 Reviewed
guzzlehttp/psr7: Malformed URI Hosts Can Fool Host Checks
Lets an attacker get past host allowlists or SSRF checks in apps that build a psr7 Uri from user input and trust getHost().
Update Guzzle to
2.12.x 2.12.3 -
medium CVE-2026-67354 Reviewed
Guzzle: Redirects Can Leak URL Fragments in the Referer Header
Can leak secrets kept in a URL fragment to a redirect target, in apps that turn on Guzzle's referer redirect option.
Update Guzzle to
7.15.x 7.15.1 -
medium CVE-2026-67355 Reviewed
Guzzle: Host-Only Cookies Are Sent to Subdomains
Can send a parent host's session cookies to its subdomains in apps that reuse one Guzzle cookie jar across hosts.
Update Guzzle to
7.15.x 7.15.1 -
medium CVE-2026-67353 Reviewed
Guzzle: Malicious Server Can Flood the Cookie Jar
Lets a malicious server fill Guzzle's cookie jar with large cookies, using memory and breaking later requests that share the jar.
Update Guzzle to
7.15.x 7.15.1 -
medium CVE-2026-59883 Reviewed
Guzzle: Cookies Set for IP Addresses Leak to Look-Alike Hosts
Can send cookies scoped to an IP address to other hosts, or let those hosts plant cookies, in apps that use Guzzle's cookie jar.
Update Guzzle to
7.12.x 7.12.3 -
medium CVE-2026-59946 Reviewed
Composer: Malicious Package Can Make Private Files World-Readable
Lets a malicious dependency change permissions on files outside its folder, making private files such as SSH keys readable by other users.
Update Composer to
2.10.x 2.10.2+ 1 older release
-
medium CVE-2026-59947 Reviewed
Composer: Tokens in Repository URLs Leak Into -vvv Debug Logs
Exposes access tokens placed in the username part of a repository URL to anyone who can read Composer's -vvv debug output.
Update Composer to
2.10.x 2.10.2+ 1 older release
-
medium CVE-2026-67339 Reviewed
Guzzle: Proxy Credentials Can Be Sent to the Destination Server
Can send Proxy-Authorization credentials to the target server when a request skips the HTTP proxy, with Guzzle's cURL handlers.
Update Guzzle to
7.14.x 7.14.2 -
high CVE-2026-59948 Reviewed
Composer: Malicious Package Name Can Write Files Outside Vendor
Lets a malicious package from a third-party repository write files anywhere the Composer user can, which can lead to running code.
Update Composer to
2.10.x 2.10.2+ 1 older release
-
high CVE-2026-12184
Failure to setup TLS with a remote server can result in a remote DoS
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.32 -
medium CVE-2026-14355
ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
Update PHP to
8.5.x 8.5.8 8.4.x 8.4.23 8.3.x 8.3.32 8.2.x 8.2.32 -
high CVE-2026-49981 Reviewed
Twig Sandbox: Allow-List Bypass When Sandbox State Changes
Lets an untrusted template use forbidden filters, tags and functions when one Twig environment renders both sandboxed and normal templates.
No fixed release listed yet
-
medium CVE-2026-55767 Reviewed
Guzzle: Cookies With a Dot-Only Domain Are Sent to Every Host
Lets a malicious server plant a cookie that Guzzle then sends to every other host using the same cookie jar.
Update Guzzle to
7.12.x 7.12.1 -
medium CVE-2026-55568 Reviewed
Guzzle: HTTPS Proxy Silently Falls Back to Cleartext on Old libcurl
Can send proxy traffic unencrypted when Guzzle is set to use an https:// proxy and the server's libcurl is older than 7.50.2.
Update Guzzle to
7.12.x 7.12.1 -
medium CVE-2026-55766 Reviewed
guzzlehttp/psr7: Header Injection Through the Method or Reason Phrase
Lets an attacker inject HTTP headers when an app puts user input in a psr7 method, protocol or reason phrase and serializes the message.
Update Guzzle to
2.12.x 2.12.1 -
medium CVE-2026-53723 Reviewed
Guzzle Services: XML Injection in Outgoing Request Bodies
Lets user input add XML markup to request bodies in apps that use guzzle-services to send XML built from that input.
Update Guzzle to
1.5.x 1.5.4 -
medium CVE-2026-48808 Reviewed
Twig Sandbox: column Filter Reads Blocked Properties Under a Source Policy
Lets an untrusted template read blocked object properties with the column filter when the sandbox is set by a source policy.
Update Twig to
3.27.x 3.27.0 -
low CVE-2026-48805 Reviewed
Twig Sandbox: Deprecated Helper Functions Skip Sandbox Checks
Lets sandboxed templates get around callable checks through deprecated Twig helper functions still used by older third-party code.
Update Twig to
3.27.x 3.27.0 -
high CVE-2026-46636 Reviewed
Twig Sandbox: Allow-List Bypass When Sandbox State Changes
Lets an untrusted template use forbidden filters, tags and functions when one Twig environment renders both sandboxed and normal templates.
Update Twig to
3.27.x 3.27.0 -
medium CVE-2026-48806 Reviewed
Twig Sandbox: __toString() Bypass via Dynamic Mapping Keys
Lets an untrusted template call __toString() on objects the sandbox policy blocks, a leftover gap from the GHSA-pr2w-4gpj-cpq4 fix.
Update Twig to
3.27.x 3.27.0 -
medium CVE-2026-48807 Reviewed
Twig Sandbox: __toString() Bypass via join, replace and in
Lets an untrusted template call __toString() on objects the sandbox policy blocks, a leftover gap from the GHSA-pr2w-4gpj-cpq4 fix.
Update Twig to
3.27.x 3.27.0 -
medium CVE-2026-48736 Reviewed
Symfony HttpClient: IPv6 Transition Addresses Bypass Private Network Block
Lets an attacker reach private network hosts through NoPrivateNetworkHttpClient by using IPv6 addresses that wrap a private IPv4 address.
Update Symfony to
7.4.x 7.4.13 6.4.x 6.4.41 5.4.x 5.4.53+ 1 older release
-
low CVE-2026-46644 Reviewed
Symfony Polyfill IDN: Invalid xn-- Labels Treated as Normal Domains
Can let two different domain names compare as equal, getting past domain blocklists, on PHP installs without the intl extension.
Only affects branches that no longer get security fixes
-
medium CVE-2026-49214 Reviewed
guzzlehttp/psr7: Header Injection Through the URI Host
Lets an attacker inject HTTP headers when an app builds a psr7 request from a user URL and serializes it as raw HTTP.
Update Guzzle to
2.10.x 2.10.2 -
medium CVE-2026-48998 Reviewed
guzzlehttp/psr7: Crafted Host Header Changes the Request's Host
Lets an attacker make an incoming request's URI host differ from its Host header in apps that build server requests with guzzlehttp/psr7.
Update Guzzle to
2.10.x 2.10.2 -
low CVE-2026-45304 Reviewed
Symfony Yaml: Alias Expansion Can Use Up All Memory
Lets a small YAML document expand into gigabytes of data through aliases, in apps that parse untrusted YAML.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
medium CVE-2026-45068 Reviewed
Symfony Mailer: Recipient Addresses Can Become Sendmail Options
Lets a recipient address starting with a dash pass options to sendmail, in apps using SendmailTransport in -t mode.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
low CVE-2026-45305 Reviewed
Symfony Yaml: Crafted Header Line Makes the Parser Hang
Lets an attacker tie up the parser for a long time with one crafted YAML header or comment line, in apps that parse untrusted YAML.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
low CVE-2026-45071 Reviewed
Symfony DomCrawler: addXmlContent() Can Read Local Files
Can expose local server files when an app loads untrusted XML with Crawler::addXmlContent(), including pages fetched by HttpBrowser.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
high CVE-2026-45067 Reviewed
Symfony Mime: Line Breaks in Addresses Allow Email Header Injection
Lets an attacker add email headers or SMTP commands through a crafted address in apps that pass user addresses to Symfony Mailer.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
low CVE-2026-45133 Reviewed
Symfony Yaml: Deeply Nested YAML Crashes the Process
Lets an attacker crash the PHP worker with one deeply nested YAML document in apps that parse untrusted YAML.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
high CVE-2026-46640 Reviewed
Twig: Code Execution Through Dynamic Macro References on _self
Lets anyone who can write a template run PHP code on the server, bypassing even a strict sandbox, in Twig 3.15 to 3.25.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46628 Reviewed
Twig: spaceless Filter Output Skips Autoescaping
Can allow cross-site scripting when templates apply the deprecated spaceless filter to user input with autoescape on.
Update Twig to
3.26.x 3.26.0 -
critical CVE-2026-46633 Reviewed
Twig: Code Execution Through a Crafted {% use %} Template Name
Lets anyone who can write a template, even a sandboxed one, run PHP code on the server through the {% use %} tag.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-47730 Reviewed
Twig Profiler: Cross-Site Scripting in HtmlDumper Output
Lets attacker-controlled template names inject HTML into Twig profiler dumps rendered with HtmlDumper.
Update Twig to
3.26.x 3.26.0 -
high CVE-2026-46639 Reviewed
Twig Sandbox: Object Destructuring Skips Property and Method Checks
Lets a sandboxed template read any public property or call any public getter through object destructuring, in Twig 3.24 and 3.25.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46627 Reviewed
Twig Sandbox: Untrusted Templates Can Use Unlimited CPU and Memory
Allows a sandboxed Twig template to use as much CPU, memory and time as it likes; Twig now documents limiting this at the process level.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46635 Reviewed
Twig Sandbox: column Filter Reads Blocked Object Properties
Lets an untrusted template read object properties the sandbox policy blocks, when the column filter is allowed.
Update Twig to
3.26.x 3.26.0 -
medium CVE-2026-46638 Reviewed
Twig Sandbox: {% sandbox %} Include Skips Checks on Cached Templates
Lets an included template use any tag, filter or function if it was loaded outside the sandbox first, through the {% sandbox %} tag.
Update Twig to
3.26.x 3.26.0 -
high CVE-2026-24425 Reviewed
Twig Sandbox: Callback Filters Accept Any PHP Callable Under a Source Policy
Lets a sandboxed template pass any PHP callable to sort, filter, map or reduce when the sandbox is set by a source policy.
Update Twig to
3.26.x 3.26.0+ 1 older release
-
high CVE-2026-47732 Reviewed
Twig Sandbox: Several Ways to Call Blocked __toString() Methods
Lets an untrusted template call __toString() on objects the sandbox policy blocks, through operators and expressions the sandbox didn't check.
Update Twig to
3.26.x 3.26.0 -
medium CVE-2026-46634 Reviewed
Twig Sandbox: template_from_string Escapes a Source Policy Sandbox
Lets a sandboxed template run any tag, filter or function when the sandbox is set by a source policy and template_from_string is allowed.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46637 Reviewed
Twig Extras: Some Filters Skip Escaping in Every Context
Can allow cross-site scripting when output from filters like html_to_markdown or markdown_to_html is used in templates without escaping.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46629 Reviewed
Twig Intl Extra: Formatter Cache Can Grow Without Limit
Lets a template use up memory outside memory_limit by passing many distinct formats to Twig's intl filters, mainly on long-running workers.
Update Twig to
3.26.x 3.26.0 -
high CVE-2026-45793 Reviewed
Composer: GitHub Tokens With Hyphens Printed in Full to CI Logs
Exposes GitHub Actions GITHUB_TOKEN values, and other GitHub tokens containing a hyphen, in Composer's error output and CI logs.
Update Composer to
2.9.x 2.9.8 1.10.x 1.10.28+ 1 older release
-
medium CVE-2026-7262
NULL pointer dereference in SOAP apache:Map decoder with missing <value>
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-7261
SoapServer session-persisted object use-after-free via SOAP header fault
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-6735
XSS within PHP-FPM status endpoint
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
high CVE-2026-6722
Use-After-Free in SOAP using Apache map with Remote Code Execution
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-7258
Out-of-bounds read in urldecode()
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-6104
Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 -
high CVE-2025-14179
SQL injection in pdo_firebird via NUL bytes in quoted strings
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
low CVE-2026-7568
Signed integer overflow in metaphone()
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
high CVE-2026-7263
DoS attack via DOMNode::C14N()
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 -
high CVE-2026-40261 Reviewed
Composer: Malicious Perforce Package Metadata Can Run Commands on Install
Lets a malicious or compromised package repository run commands when Composer installs packages from source, even without Perforce installed.
Update Composer to
2.9.x 2.9.6+ 1 older release
-
high CVE-2026-40176 Reviewed
Composer: Perforce Settings in an Untrusted composer.json Can Run Commands
Lets a malicious project's composer.json run commands on your machine when you run Composer in it, even without Perforce installed.
Update Composer to
2.9.x 2.9.6+ 1 older release
-
medium CVE-2026-24739 Reviewed
Symfony Process on Windows: Git Bash Can Mangle Arguments and Hit Wrong Paths
Can make file commands run through Symfony Process act on the wrong path, up to deleting a whole directory, when PHP runs from Git Bash.
Update Symfony to
7.4.x 7.4.5 6.4.x 6.4.33 5.4.x 5.4.51+ 2 older releases
-
low CVE-2025-67746 Reviewed
Composer: Remote Sources Can Inject Terminal Control Codes Into Output
Lets a source Composer downloads from inject ANSI control characters that garble Composer's terminal output.
Update Composer to
2.9.x 2.9.3+ 1 older release
-
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
medium CVE-2025-14180
NULL Pointer Dereference in PDO quoting
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
medium CVE-2025-14178
Heap buffer overflow in array_merge()
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
medium CVE-2025-14177
Information Leak of Memory in getimagesize
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
medium CVE-2025-1735
pgsql extension does not check for errors during escaping
Update PHP to
8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29+ 1 older release
-
medium CVE-2025-6491
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
Update PHP to
8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29+ 1 older release
-
low CVE-2025-1220
Null byte termination in hostnames
Update PHP to
8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29+ 1 older release
-
medium CVE-2024-11235
Reference counting in php_request_shutdown causes Use-After-Free
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 -
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1219
libxml streams use wrong `content-type` header when requesting a redirected resource
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1736
Stream HTTP wrapper header check might omit basic auth header
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1861
Stream HTTP wrapper truncate redirect location to 1024 bytes
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1734
Streams HTTP wrapper does not fail for headers with invalid name and no colon
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1217
Header parser of `http` stream wrapper does not handle folded headers
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-24374 Reviewed
Twig: Null Coalesce Operator Skips Output Escaping
Leaves the left side of a ?? expression unescaped in Twig templates, so user input there can carry HTML or script into the page.
Update Twig to
3.19.x 3.19.0 -
medium CVE-2025-21617 Reviewed
Guzzle OAuth Subscriber: Weak Nonces Can Allow Replayed OAuth 1 Requests
Generates weak OAuth 1 nonces, which can leave the servers your app calls open to replayed requests when the connection doesn't use TLS.
Update Guzzle to
0.8.x 0.8.1 -
high CVE-2024-8929
[Mysqlnd] Leak partial content of the heap through heap buffer over-read
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-8932
OOB access in ldap_escape
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-11234
Configuring a proxy in a stream context might allow for CRLF injection in URIs
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-11236
Integer overflow in the firebird and dblib quoters causing OOB writes
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-11233
Single byte overread with convert.quoted-printable-decode filter
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
low CVE-2024-50342 Reviewed
Symfony HttpClient: NoPrivateNetworkHttpClient Leaks Internal Hosts and Ports
Can let an attacker map internal IP addresses and ports through apps that fetch user-supplied URLs with NoPrivateNetworkHttpClient.
Update Symfony to
6.4.x 6.4.15 5.4.x 5.4.47+ 1 older release
-
low CVE-2024-51754 Reviewed
Twig Sandbox: __toString() Runs on Objects in Arrays Without a Check
Lets untrusted templates call __toString() on objects the sandbox policy blocks, when the object sits in an array or an argument list.
Update Twig to
3.14.x 3.14.1+ 1 older release
-
low CVE-2024-51755 Reviewed
Twig Sandbox: Array-Like Objects Skip the Security Policy
Lets untrusted templates read properties of ArrayAccess objects that the sandbox policy should block, in apps that run user templates in Twig's sandbox.
Update Twig to
3.14.x 3.14.1+ 1 older release
-
high CVE-2024-51736 Reviewed
Symfony Process on Windows: A cmd.exe in the Working Directory Gets Run
Lets a cmd.exe file in the current working directory run instead of the real one when Symfony's Process class runs commands on Windows.
Update Symfony to
6.4.x 6.4.14 5.4.x 5.4.46+ 1 older release
-
high CVE-2024-4577
PHP RCE: A Bypass of CVE-2012-1823, Argument Injection in PHP-CGI
Update PHP to
8.3.x 8.3.8 8.2.x 8.2.20+ 1 older release
-
medium CVE-2024-8927
cgi.force_redirect configuration is bypassable due to the environment variable collision
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
medium CVE-2024-8926
PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
low CVE-2024-8925
Erroneous parsing of multipart form data
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
low CVE-2024-9026
[PHP-FPM] Logs from childrens may be altered
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
medium CVE-2024-45411 Reviewed
Twig Sandbox: Templates Included in Sandbox Mode Can Skip Its Checks
Lets user-written templates escape sandbox rules when the sandbox is off globally and turned on only through a sandboxed include().
Update Twig to
3.14.x 3.14.0 2.16.x 2.16.0+ 2 older releases
-
high CVE-2024-35241 Reviewed
Composer: Malicious Git Branch Names Can Run Code on status or remove
Lets a malicious package repository run commands on your machine when you run composer status, reinstall or remove on source installs.
Update Composer to
2.7.x 2.7.7+ 1 older release
-
high CVE-2024-35242 Reviewed
Composer: Malicious Git or Hg Branch Names Can Run Code on composer install
Lets an untrusted repository run commands on your machine when you clone it and run composer install inside it.
Update Composer to
2.7.x 2.7.7+ 1 older release
-
high CVE-2024-5585
bypass CVE-2024-1874
Update PHP to
8.3.x 8.3.8 8.2.x 8.2.20+ 1 older release
-
medium CVE-2024-5458
Filter bypass in filter_var (FILTER_VALIDATE_URL)
Update PHP to
8.3.x 8.3.8 8.2.x 8.2.20+ 1 older release
-
high CVE-2024-2757
mb_encode_mimeheader runs endlessly for some inputs
Update PHP to
8.3.x 8.3.6 -
low CVE-2024-3096
password_verify can erroneously return true, opening ATO risk
Update PHP to
8.3.x 8.3.6 8.2.x 8.2.18+ 1 older release
-
critical CVE-2024-1874
Command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows
Update PHP to
8.3.x 8.3.6 8.2.x 8.2.18+ 1 older release
-
medium CVE-2024-2756
__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
Update PHP to
8.3.x 8.3.6 8.2.x 8.2.18+ 1 older release
-
high CVE-2024-24821 Reviewed
Composer: Tampered vendor/composer Files Run Code When Composer Runs
Lets code planted in a project's vendor/composer files run as whoever runs Composer there, including root when Composer runs with sudo.
Update Composer to
2.7.x 2.7.0+ 1 older release
-
high CVE-2023-43655 Reviewed
Composer: A Web-Accessible composer.phar Can Let Attackers Run Code
Lets an attacker run code on a server that publishes composer.phar where PHP executes it and register_argc_argv is enabled.
Update Composer to
2.6.x 2.6.4 1.10.x 1.10.27+ 1 older release
-
low CVE-2023-3247
Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
Update PHP to
8.2.x 8.2.7+ 1 older release
-
medium CVE-2023-29197 Reviewed
Guzzle PSR-7: Newlines Allowed in Header Names and Values
Allows header injection when untrusted input containing a newline ends up in header names or values built with guzzlehttp/psr7.
Update Guzzle to
2.4.x 2.4.5 1.9.x 1.9.1 -
low CVE-2023-0567
BCrypt hashes erroneously validate if the salt is cut short by `$`
Update PHP to
8.2.x 8.2.3+ 1 older release
-
high CVE-2023-0662
DoS vulnerability when parsing multipart request body
Update PHP to
8.2.x 8.2.3+ 1 older release
-
high CVE-2022-39261 Reviewed
Twig Filesystem Loader: Template Names Can Reach Files Outside Its Directories
Lets an attacker read files outside the template directories in apps that pass user input as a template name to the filesystem loader.
Update Twig to
3.4.x 3.4.3 2.15.x 2.15.3+ 1 older release
-
high CVE-2022-31091
Change in port should be considered a change in origin
Update Guzzle to
7.4.x 7.4.5 6.5.x 6.5.8 -
high CVE-2022-31090
CURLOPT_HTTPAUTH option not cleared on change of origin
Update Guzzle to
7.4.x 7.4.5 6.5.x 6.5.8 -
high CVE-2022-31043
Fix failure to strip Authorization header on HTTP downgrade
Update Guzzle to
7.4.x 7.4.4 6.5.x 6.5.7 -
high CVE-2022-31042
Failure to strip the Cookie header on change in host or HTTP downgrade
Update Guzzle to
7.4.x 7.4.4 6.5.x 6.5.7 -
high CVE-2022-29248
Cross-domain cookie leakage
Update Guzzle to
7.4.x 7.4.3 6.5.x 6.5.6 -
high CVE-2022-24828
Missing input validation can lead to command execution in composer
Update Composer to
2.3.x 2.3.5 1.10.x 1.10.26+ 1 older release
-
medium CVE-2022-24775
Inproper parsing of HTTP headers
Update Guzzle to
2.1.x 2.1.1 1.8.x 1.8.4 -
high CVE-2022-23614
Disallow non closures in the sort filter
Update Twig to
3.3.x 3.3.8 2.14.x 2.14.11 -
medium CVE-2021-41270
CVE-2021-41270: Prevent CSV Injection via formulas
Only affects branches that no longer get security fixes
-
high CVE-2021-41116
Improper escaping of command arguments on Windows leading to command injection
Update Composer to
2.1.x 2.1.9 1.10.x 1.10.23 -
high CVE-2021-29472
Missing argument delimiter can lead to command execution via VCS repository URLs or source download URLs on systems with Mercurial
Update Composer to
2.0.x 2.0.13 1.10.x 1.10.22 -
high CVE-2019-18888
CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser
Only affects branches that no longer get security fixes
-
low CVE-2019-9942
Sandbox Information Disclosure
Update Twig to
2.7.x 2.7.0 1.38.x 1.38.0 -
high CVE-2016-5385
HTTP Proxy header vulnerability
Update Guzzle to
8.1.x 8.1.7 6.2.x 6.2.1 5.3.x 5.3.1+ 1 older release
-
high CVE-2015-8371
Composer Cache Injection vulnerability
Update Composer to
1.0.x 1.0.0-beta1 -
high CVE-2015-7809
Remote code execution in templates
Update Twig to
1.20.x 1.20.0 -
medium CVE-2013-5958
Possible DOS attack with long user-submitted passwords
Only affects branches that no longer get security fixes
-
Update Twig to
1.12.x 1.12.3 -
high CVE-2013-1397
Ability to enable/disable object support in YAML parsing and dumping
Only affects branches that no longer get security fixes
-
high CVE-2013-1348
Ability to enable/disable PHP parsing in Yaml::parse()
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes