High, CVSS 7.8PackagistPublished
symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest
CVE-2026-55878 · GHSA-p9xj-fpr2-jf2q
- Affected
- Packagist symfony/ux-toolkit >= 2.32.0, < 2.36.1; >= 3.0.0, < 3.2.0
- Fixed in
- 2.36.13.2.0· Vendor fix available
- Issue
- The ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map. The only guard against malicious paths was Path::isRelative(), which returns true for paths like ../../../etc. Path::join() then resolves the .. segments without complaint, so the final path can escape the intended directory entirely. A crafted or compromised kit can therefore write attacker-controlled content to arbitrary locations on the developer's machine or CI runner. Because the copy operation creates missing parent directories and can overwrite existing files silently (with --force or in non-interactive environments), an attacker who controls a kit can overwrite files such as controllers, git hooks, or .env to achieve code execution. The source side of copy-files is symmetrically affected, enabling local file reads outside the recipe directory. Resolution The fix introduces an Assert::pathDoesNotEscapeDirectory() helper that rejects any copy-files source or…
Recommended action: Upgrade to 3.2.0 or 2.36.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.