CVE-2023-46734Medium· 6.1▾ Sunlit

Symfony is a PHP framework for web and console applications and a set of reusable PHP components

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score34/ 100 · Low

impact 33.6 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Nov 10, 2023

Updated

Jul 29, 2026

CVSS

6.1

Vendor

sensiolabs

Product

symfony

CWE

CWE-79

Depth score

34 · Low

EPSS

0.69% · p51

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Jul 29.

0.7% → 0.7%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 1048 days

Nov 10, 2023Published
Disclosed via NVD
Jul 29, 2026Record revised
Last analysed / modified upstream
Jul 29, 2026EPSS first tracked
0.7%
Sep 23, 2026EPSS peak
0.7% → 0.7%

sensiolabs CWE-79 #nvd

Affected

debian_linux = 10.0
symfony >= 2.0.0, < 4.4.51
symfony >= 5.0.0, < 5.4.31
symfony >= 6.0.0, < 6.3.8
twig-bridge >= 2.0.0, < 4.4.51
twig-bridge >= 5.0.0, < 5.4.31
twig-bridge >= 6.0.0, < 6.3.8

Patched in

symfony 6.3.8
twig-bridge 6.3.8

Full technical detail▾

Overview

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use is_safe=html but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.

Affected

debian_linux = 10.0
symfony >= 2.0.0, < 4.4.51
symfony >= 5.0.0, < 5.4.31
symfony >= 6.0.0, < 6.3.8
twig-bridge >= 2.0.0, < 4.4.51
twig-bridge >= 5.0.0, < 5.4.31
twig-bridge >= 6.0.0, < 6.3.8

Remediation

Upgrade past the affected range:

symfony 6.3.8
twig-bridge 6.3.8

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed

CVE-2023-46734Medium· 6.1▾ Sunlit

Symfony is a PHP framework for web and console applications and a set of reusable PHP components

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score34/ 100 · Low

impact 33.6 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Nov 10, 2023

Updated

Jul 29, 2026

CVSS

6.1

Vendor

sensiolabs

Product

symfony

CWE

CWE-79

Depth score

34 · Low

EPSS

0.69% · p51

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Jul 29.

0.7% → 0.7%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 1048 days

Nov 10, 2023Published
Disclosed via NVD
Jul 29, 2026Record revised
Last analysed / modified upstream
Jul 29, 2026EPSS first tracked
0.7%
Sep 23, 2026EPSS peak
0.7% → 0.7%

sensiolabs CWE-79 #nvd

Affected

debian_linux = 10.0
symfony >= 2.0.0, < 4.4.51
symfony >= 5.0.0, < 5.4.31
symfony >= 6.0.0, < 6.3.8
twig-bridge >= 2.0.0, < 4.4.51
twig-bridge >= 5.0.0, < 5.4.31
twig-bridge >= 6.0.0, < 6.3.8

Patched in

symfony 6.3.8
twig-bridge 6.3.8

Full technical detail▾

Overview

Affected

debian_linux = 10.0
symfony >= 2.0.0, < 4.4.51
symfony >= 5.0.0, < 5.4.31
symfony >= 6.0.0, < 6.3.8
twig-bridge >= 2.0.0, < 4.4.51
twig-bridge >= 5.0.0, < 5.4.31
twig-bridge >= 6.0.0, < 6.3.8

Remediation

Upgrade past the affected range:

symfony 6.3.8
twig-bridge 6.3.8

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd