GHSA-x6g4-fwcc-jj8w Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

• Packagist symfony/dom-crawler: < 5.4.52 → fixed in 5.4.52 • Packagist symfony/symfony: < 5.4.52 → fixed in 5.4.52 • Packagist symfony/dom-crawler: >= 6.0.0, < 6.4.40 → fixed in 6.4.40 • Packagist symfony/dom-crawler: >= 7.0.0, < 7.4.12 → fixed in 7.4.12 • Packagist symfony/dom-crawler: >= 8.0.0, < 8.0.12 → fixed in 8.0.12 • Packagist symfony/symfony: >= 6.0.0, < 6.4.40 → fixed in 6.4.40 • Packagist symfony/symfony: >= 7.0.0, < 7.4.12 → fixed in 7.4.12 • Packagist symfony/symfony: >= 8.0.0, < 8.0.12 → fixed in 8.0.12

Description `symfony/dom-crawler` provides the `Crawler` class for navigating HTML/XML documents with CSS/XPath selectors; `symfony/browser-kit`'s `HttpBrowser` uses it to parse fetched pages. `Crawler::addXmlContent()` sets `DOMDocument::$validateOnParse = true` before calling `loadXML()`. Setting `validateOnParse` re-enables libxml's DTD subset processing, including external entity resolution, even though `LIBXML_NONET` is passed. `LIBXML_NONET` blocks network fetches but not `file://` entities. An attacker-supplied XML document with a `SYSTEM "file:///etc/passwd"` entity is therefore expanded. Resolution The `Crawler::addXmlContent` method does not set the `validateOnParse` flag anymore. The patch for this issue is available here for branch 5.4. Credits Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.