symfony/web-profiler-bundle

Provides a development tool that gives detailed information about the execution of any request

View on Packagist

View on Github

Activity

Latest release: 1w ago
Total releases: 559
Cadence: ~daily
Last 12 months: 53

Reach

Stars: 2.3k

Details

License: MIT
First release: Nov 24, 2011

Releases

Version	Released
`v8.1.7` patch	Sep 04, 2026
`v7.4.19` patch	Sep 04, 2026
`v6.4.46` patch	Sep 02, 2026
`v8.1.5` patch	Aug 22, 2026
`v7.4.17` patch	Aug 22, 2026
`v6.4.44` patch	Aug 22, 2026
`v8.1.4` patch	Aug 01, 2026
`v7.4.16` patch	Aug 01, 2026
`v7.4.15` patch	Jul 21, 2026
`v6.4.43` patch	Jul 21, 2026
`v8.0.15` patch	Jul 19, 2026
`v8.1.2` patch	Jul 09, 2026
`v8.1.1` patch	Jun 05, 2026
`v8.0.14` patch	Jun 05, 2026
`v7.4.14` patch	Jun 05, 2026
`v6.4.42` patch	Jun 05, 2026
`v8.1.0` minor	May 29, 2026
`v8.1.0-RC1` pre	May 23, 2026
`v8.0.13` patch	May 23, 2026
`v7.4.13` patch	May 23, 2026
`v6.4.41` patch	May 20, 2026
`v8.1.0-BETA3` pre	May 20, 2026
`v8.0.12` patch	May 20, 2026
`v7.4.12` patch	May 20, 2026
`v8.1.0-BETA2` pre	May 11, 2026
`v8.0.11` patch 1 CVE	May 11, 2026
`v7.4.11` patch 1 CVE	May 11, 2026
`v6.4.39` patch	May 10, 2026
`v8.1.0-BETA1` pre	May 05, 2026
`v8.0.9` patch 1 CVE	Apr 29, 2026
`v7.4.9` patch 1 CVE	Apr 22, 2026
`v8.0.8` patch 1 CVE	Mar 30, 2026
`v7.4.8` patch 1 CVE	Mar 24, 2026
`v6.4.36` patch	Mar 17, 2026
`v8.0.7` patch 1 CVE	Mar 04, 2026
`v7.4.7` patch 1 CVE	Mar 03, 2026
`v6.4.35` patch	Mar 03, 2026
`v8.0.6` patch 1 CVE	Feb 13, 2026
`v7.4.6` patch 1 CVE	Feb 11, 2026
`v6.4.34` patch	Feb 05, 2026
`v8.0.4` patch 1 CVE	Jan 07, 2026
`v7.4.4` patch 1 CVE	Jan 07, 2026
`v7.3.10` patch 1 CVE	Jan 07, 2026
`v6.4.32` patch	Jan 06, 2026
`v8.0.3` patch 1 CVE	Dec 27, 2025
`v7.4.3` patch 1 CVE	Dec 27, 2025
`v7.3.9` patch 1 CVE	Dec 26, 2025
`v8.0.0` major 1 CVE	Nov 20, 2025
`v7.4.0` minor 1 CVE	Nov 19, 2025
`v8.0.0-RC1` pre	Oct 10, 2025

1–50 of 559

Repository

symfony/web-profiler-bundle

Forks: 60
Open issues: 0
Language: Twig
: 4.5/ 10

php
symfony
component
symfony-component
dev

Dependencies (5)

Depends on

v8.1.7

Used by

Supply-chain exposure

89 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (2)

CVE-2026-45072 GHSA-hmr5-2xcr-v8pp May 27, 2026

Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering

Low
Network Low Low

Description

Symfony's profiler, a development only debug UI, renders source-code excerpts on several pages using Twig's custom file_excerpt filter. This filter renders PHP files via highlight_string() (which escapes HTML), but renders non-PHP files by splitting on \n and interpolating each line directly into <code>{$line}</code> with no escaping.

An attacker who can write arbitrary bytes into any file under the project root (including e.g. var/log/dev.log), achieves stored XSS against any developer who later opens that file in the profiler.

Resolution

The file_excerpt filter now properly escapes each line of non-PHP files using htmlspecialchars() before concatenating them.

The patch for this issue is available here for branch 6.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Affected versions

v7.2.9v7.3.0v7.3.0-BETA1v7.3.0-RC1v7.3.1v7.3.10v7.3.2v7.3.3v7.3.4v7.3.5v7.3.9v7.4.0

+ 18 more Show less

v7.4.0-BETA1v7.4.0-RC1v7.4.0-RC3v7.4.11v7.4.3v7.4.4v7.4.6v7.4.7v7.4.8v7.4.9v8.0.0v8.0.11v8.0.3v8.0.4v8.0.6v8.0.7v8.0.8v8.0.9

Fixed in

7.4.128.0.12

References

https://github.com/symfony/symfony/security/advisories/GHSA-hmr5-2xcr-v8pp
https://github.com/symfony/symfony/commit/863aa81c61166f1aa74b7732df316f76113acbdb
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45072.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/twig-bridge/CVE-2026-45072.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/web-profiler-bundle/CVE-2026-45072.yaml
https://github.com/symfony/symfony

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2014-6072 GHSA-v35g-4rrw-h4fw May 30, 2024

Symfony Cross-Site Request Forgery vulnerability in the Web Profiler

8.1 / 10
High
Network High None None Unchanged High High High

All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony WebProfiler bundle are affected by this security issue.

This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore.

Description

The Symfony Web Profiler is a great development tool, but it should not be enabled on production servers. If it is enabled in production, it must be properly secured so that only authorized people have access to it. Developers must be very cautious about this as the Web Profiler gives many sensitive information about a Symfony project and any attackers can exploit many of them. Just to name a few sensitive information: user logins, user cookies, executed SQL statements, ...

That being said, the import/export feature of the web profiler is exploitable even if the Web Profiler is secured as the form to import a profiler is not protected against CSRF attacks. Combined with the fact that profiles are imported as a PHP serialized string, it makes your application vulnerable to code injection.

Resolution

As the import/export feature of the Web Profiler is not that useful, and because PHP serialize/unserialize functions have a long history of vulnerabilities, I decided to remove this feature from the Web interface and move it as CLI commands.

If you were relying on this feature, you now need to use the profiler:import and profiler:export Symfony commands provided by the WebProfiler bundle from the command line interface.

Those commands are not enabled by default and must be activated explicitly. For Symfony 2.4+, you can import them in your app/config.yml configuration file:

import: - { resource: "%kernel.root_dir%/../vendor/symfony/symfony/src/Symfony/Bundle/WebProfilerBundle/Resources/config/commands.xml" }

For Symfony 2.3, you can use the following snippet of code in app/console:

$kernel = new AppKernel($env, $debug); $application = new Application($kernel); if ($kernel->getContainer()->has('profiler')) { $profiler = $kernel->getContainer()->get('profiler'); $application->add(new ImportCommand($profiler)); $application->add(new ExportCommand($profiler)); } $application->run($input);

At this point, I want to reiterate that you should never enable the Symfony Web Profiler on your production servers as this is a development tool. And if you need to enable it, double-check that it is properly secured.

The patch for this issue is available here: https://github.com/symfony/symfony/pull/11832

Affected versions

2.0.7v2.0.10v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18v2.0.19v2.0.20v2.0.21

+ 63 more Show less

v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.2v2.3.3v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9v2.4.0v2.4.1v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.5.0v2.5.1v2.5.2v2.5.3

Fixed in

2.3.192.4.92.5.4

References

https://github.com/symfony/symfony/pull/11832
https://github.com/symfony/symfony/commit/f38536ab79058f6a934426c41170256ba9623a02
https://github.com/symfony/web-profiler-bundle/commit/5b589ba83faf7eb20cec50725cd657075aebdd36
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2014-6072.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/web-profiler-bundle/CVE-2014-6072.yaml
https://symfony.com/cve-2014-6072

Updated May 30, 2024 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 6
minor 29
patch 457
pre 66

559 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More