symfony/ux-toolkit

A tool to easily create a design system in your Symfony app with customizable, well-crafted Twig components

View on Packagist

View on Github

Activity

Latest release: 2w ago
Total releases: 12
Cadence: ~22 days
Last 12 months: 12

Reach

Stars: 16

Details

License: MIT
First release: Jan 01, 2026

Releases

Version	Released
`v3.6.0` minor	Oct 13, 2026
`v3.5.1` patch	Sep 19, 2026
`v3.5.0` minor	Sep 19, 2026
`v3.4.0` minor	Jul 31, 2026
`v3.3.0` minor	Jul 09, 2026
`v3.2.0` minor	Jun 19, 2026
`v2.36.1` patch	Jun 19, 2026
`v3.1.0` minor 1 CVE	May 27, 2026
`v3.0.0` major 1 CVE	Apr 09, 2026
`v2.36.0` minor 1 CVE	Apr 04, 2026
`v2.34.0` minor 1 CVE	Mar 15, 2026
`v2.32.0` initial 1 CVE	Jan 01, 2026

Repository

symfony/ux-toolkit

Forks: 0
Open issues: 0
Language: HTML

javascript
symfony
symfony-ux
ux
components
design-system

Dependencies (10)

Depends on

v3.6.0

Used by

Supply-chain exposure

1 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2026-55878 GHSA-p9xj-fpr2-jf2q Jun 19, 2026

symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest

7.8 / 10
High
Local Low None Required Unchanged High High High

Description

The ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map. The only guard against malicious paths was Path::isRelative(), which returns true for paths like ../../../etc. Path::join() then resolves the .. segments without complaint, so the final path can escape the intended directory entirely. A crafted or compromised kit can therefore write attacker-controlled content to arbitrary locations on the developer's machine or CI runner.

Because the copy operation creates missing parent directories and can overwrite existing files silently (with --force or in non-interactive environments), an attacker who controls a kit can overwrite files such as controllers, git hooks, or .env to achieve code execution. The source side of copy-files is symmetrically affected, enabling local file reads outside the recipe directory.

Resolution

The fix introduces an Assert::pathDoesNotEscapeDirectory() helper that rejects any copy-files source or destination path containing a .. segment, regardless of whether / or \ is used as the separator. This check is enforced in both RecipeManifest (which also guards the source Finder) and File. As a last line of defense, the installer re-verifies the fully resolved paths with Path::isBasePath() immediately before each filesystem read and write.

Credits

Symfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.

Affected versions

v2.32.0v2.33.0v2.34.0v2.35.0v2.36.0v3.0.0v3.1.0

Fixed in

2.36.13.2.0

References

https://github.com/symfony/ux/security/advisories/GHSA-p9xj-fpr2-jf2q
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-toolkit/CVE-2026-55878.yaml
https://github.com/symfony/ux

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 1
minor 8
patch 2

12 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More