CVE-2020-25912

CriticalCVSS 9.1

Published: 31/10/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.34%

68th percentile - higher than 68% of all known CVEs

Summary

An XML External Entity (XXE) vulnerability was found in Symphony 2.7.10 in the class.xmlelement.php file, potentially leading to information disclosure or denial of service (DOS).

Risk Assessment

An attacker can remotely read sensitive files on the server or cause system overload, threatening data confidentiality and availability.

Recommendation

Immediately update Symphony to the latest version and disable external XML entity processing in the parser configuration.

Original NVD description (English source)

A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS).