CVE-2023-46734

MediumCVSS 6.1

Published: 10/11/2023(UTC)Updated: 29/07/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.68%

49th percentile - higher than 49% of all known CVEs

Summary

In Symfony from versions 2.0.0, 5.0.0, and 6.0.0 up to 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but do not actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony escapes the output of the affected filters.

Risk Assessment

This vulnerability can lead to Cross-Site Scripting (XSS) attacks because input is not properly sanitized against HTML/JavaScript injection.

Recommendation

Upgrade Symfony to version 4.4.51, 5.4.31, 6.3.8, or later.

Original NVD description (English source)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.