# CVE-2026-123824: Symfony Config XmlUtils XML external entity injection

Source: https://junglewise.ai/threats/cve-2026-123824-the-symfony-config-component-xmlutils-parse-enables-dtd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-123824 · Severity: info · Published 2026-11-06

The Symfony Config component processes XML files from configuration and translation sources without properly preventing XML External Entity (XXE) attacks. An attacker who can supply malicious XML can probe for the existence of files on the server, cause the application to hang or crash by referencing large files, and potentially leak file contents to external servers if certain stream wrappers are configured.

Vendors: [Symfony](https://junglewise.ai/threats/vendors/symfony).

## Quick answers

**Is CVE-2026-123824 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123824 being exploited in the wild.

**How severe is CVE-2026-123824?** Informational severity, published 6 November 2026.

**Which products and versions are affected?** Symfony Config 5.x before 5.4.56, 6.x before 6.4.50, 7.x before 7.4.23, 8.x before 8.1.11.

**Is there a fix for CVE-2026-123824?** Yes: fixed in Config 5.4.56, 6.4.50, 7.4.23, 8.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123824 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123824?** Check whether you run Symfony Config at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Config 5.4.56, 6.4.50, 7.4.23, 8.1.11

## Technical details

The XmlUtils::parse() method enables DTD validation before rejecting doctypes, allowing libxml to resolve external entities during XML parsing. Although LIBXML_NONET blocks http:// URLs, it does not block file:// URLs, which are resolved from disk before the doctype rejection check runs. Attackers can craft XML entities that reveal file existence through distinct error messages, cause denial of service by referencing large files, or exfiltrate content via registered stream wrappers like s3://.

## Affected products

- Symfony Config 5.x before 5.4.56, 6.x before 6.4.50, 7.x before 7.4.23, 8.x before 8.1.11

## Timeline

- 2026-11-06: disclosed