# CVE-2026-55878: Symfony UX Toolkit path traversal in ux:install command

Source: https://junglewise.ai/threats/cve-2026-55878-symfony-ux-toolkit-path-traversal-in-ux-install-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-55878 · Severity: high · CVSS 7.8 · Published 2026-07-08

Symfony UX is a set of tools used by developers to integrate JavaScript into Symfony web applications. A security flaw in its installation command allows a malicious or compromised "recipe kit" to write files to unauthorized locations on a developer's computer or automated build system. This could allow an attacker to overwrite critical system files, steal sensitive data, or gain full control over the affected machine when a developer attempts to install a malicious package.

Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Symfony](https://junglewise.ai/threats/vendors/symfony).

## Quick answers

**Is CVE-2026-55878 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55878 being exploited in the wild.

**How severe is CVE-2026-55878?** High severity, with a CVSS score of 7.8, published 8 July 2026.

**Which products and versions are affected?** symfony/ux-toolkit (Packagist) ECOSYSTEM:introduced=2.32.0,fixed=2.36.1; Symfony UX Toolkit >= 2.32.0, < 2.36.1; >= 3.0.0, < 3.2.0.

**Is there a fix for CVE-2026-55878?** Yes. symfony/ux-toolkit (Packagist): upgrade to 2.36.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55878 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-55878?** Check whether you run symfony/ux-toolkit (Packagist) or Symfony UX Toolkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- symfony/ux-toolkit (Packagist): upgrade to 2.36.1 or later

  ```sh
  composer require symfony/ux-toolkit:^2.36.1
  ```


## Technical details

A path traversal vulnerability exists in the `ux:install` console command of Symfony UX Toolkit. The command processes a `copy-files` map from recipe kits using `Path::isRelative()`, which fails to block relative path segments like `../../`. An attacker can craft a malicious recipe manifest that uses these segments to escape the intended directory, enabling arbitrary file writes (e.g., overwriting controllers or git hooks) and arbitrary file reads on the host system. The vulnerability is exploited when a user interacts with a compromised kit. The fix introduces `Assert::pathDoesNotEscapeDirectory()` to reject paths containing `..` segments and adds `Path::isBasePath()` checks before filesystem operations.

## Affected products

- Symfony ux-toolkit >= 2.32.0, < 2.36.1; >= 3.0.0, < 3.2.0

## Identifiers

- CVE-2026-55878
- GHSA-p9xj-fpr2-jf2q

## Timeline

- 2026-06-19: patched: Fixes released in versions 2.36.1 and 3.2.0
- 2026-07-08: advisory: CVE-2026-55878 published

## References

- [https://github.com/symfony/ux/commit/7b4ddf3764bf269a1b5fde5bf03c4bce568694e4](https://github.com/symfony/ux/commit/7b4ddf3764bf269a1b5fde5bf03c4bce568694e4)
- [https://github.com/symfony/ux/releases/tag/v2.36.1](https://github.com/symfony/ux/releases/tag/v2.36.1)
- [https://github.com/symfony/ux/releases/tag/v3.2.0](https://github.com/symfony/ux/releases/tag/v3.2.0)
- [https://github.com/symfony/ux/security/advisories/GHSA-p9xj-fpr2-jf2q](https://github.com/symfony/ux/security/advisories/GHSA-p9xj-fpr2-jf2q)