Update dependency symfony/dom-crawler to v6.4.40 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
symfony/dom-crawler (source)	6.4.19 → 6.4.40

---

Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

CVE-2026-45071 / GHSA-x6g4-fwcc-jj8w

More information

Details

Description

symfony/dom-crawler provides the Crawler class for navigating HTML/XML documents with CSS/XPath selectors; symfony/browser-kit's HttpBrowser uses it to parse fetched pages.

Crawler::addXmlContent() sets DOMDocument::$validateOnParse = true before calling loadXML(). Setting validateOnParse re-enables libxml's DTD subset processing, including external entity resolution, even though LIBXML_NONET is passed. LIBXML_NONET blocks network fetches but not file:// entities. An attacker-supplied XML document with a SYSTEM "file:///etc/passwd" entity is therefore expanded.

Resolution

The Crawler::addXmlContent method does not set the validateOnParse flag anymore.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Severity

• CVSS Score: 1.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

References

• https://github.com/symfony/symfony/security/advisories/GHSA-x6g4-fwcc-jj8w
• https://github.com/symfony/symfony/commit/eea5fd7488cbdc241da4ce242344b7d9a3ecdf3d
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/dom-crawler/CVE-2026-45071.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45071.yaml
• https://symfony.com/cve-2026-45071
• https://github.com/advisories/GHSA-x6g4-fwcc-jj8w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

symfony/dom-crawler (symfony/dom-crawler)

v6.4.40

Compare Source

Changelog (symfony/dom-crawler@v6.4.23...v6.4.40)

• bug #​64258 Fix ChoiceFormField::addChoice() clobbering values on multi-selects (@​nicolas-grekas)
• security #cve-2026-45071 Fix XXE in addXmlContent() by not enabling validateOnParse (@​alexandre-daubois)

v6.4.34

Compare Source

Changelog (symfony/dom-crawler@v6.4.33...v6.4.34)

• no significant changes

v6.4.32

Compare Source

Changelog (symfony/dom-crawler@v6.4.31...v6.4.32)

• no significant changes

v6.4.25

Compare Source

Changelog (symfony/dom-crawler@v6.4.24...v6.4.25)

• no significant changes

v6.4.24

Compare Source

Changelog (symfony/dom-crawler@v6.4.23...v6.4.24)

• no significant changes

v6.4.23

Compare Source

Changelog (symfony/dom-crawler@v6.4.22...v6.4.23)

• bug symfony/symfony#60781 [DomCrawler] Allow selecting buttons by their value (@​MatTheCat)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.