Symfony is a widely adopted PHP web-application framework whose vulnerability footprint, though narrow in product scope, reflects its prominence in the application-development ecosystem. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and concentrate in core components such as Twig templating and UX utilities, where they manifest through code-injection pathways, protection-mechanism failures, cleartext storage, input-validation gaps, and path-traversal weaknesses that are characteristic of template engines and framework utilities handling untrusted input. Developers should treat Symfony advisories as urgent across affected application codebases; live severity and exploitation metrics are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Symfony over time
Signals from CVEs in this vendor scope (33 CVEs).
33 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-46633CRITICAL Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quote | Jul 14, 2026 | 9.8 | 43 | NO | NO |
CVE-2026-46640HIGH Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a Macro | Jul 14, 2026 | 8.8 | 39 | NO | NO |
CVE-2026-46634CRITICAL Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall out | Jul 14, 2026 | 9.8 | 39 | NO | NO |
CVE-2026-24425CRITICAL Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities t | May 20, 2026 | 9.9 | 39 | NO | NO |
CVE-2026-48807CRITICAL Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated | Jul 14, 2026 | 9.1 | 37 | NO | NO |
CVE-2026-48805CRITICAL Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow() | Jul 14, 2026 | 9.1 | 37 | NO | NO |
CVE-2026-48806CRITICAL Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stri | Jul 14, 2026 | 9.1 | 36 | NO | NO |
CVE-2022-23614CRITICAL Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrar | Feb 4, 2022 | 9.8 | 36 | NO | NO |
CVE-2026-49981HIGH Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can rema | Jul 14, 2026 | 8.2 | 35 | NO | NO |
CVE-2026-48808HIGH Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::ch | Jul 14, 2026 | 7.5 | 33 | NO | NO |
Signals from CVEs in this vendor scope (33 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Symfony.
Media articles that mention a CVE ID that affects a product developed by Symfony — matched by CVE ID, not by vendor name.