CVE-2026-55878

🗓️ 08 Jul 2026 21:30:33Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 18 Views

CVE-2026-55878: Symfony ux-toolkit path traversal enables arbitrary file write and read via crafted recipe manifest.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-55878	8 Jul 202621:30	–	attackerkb
Cvelist	CVE-2026-55878 Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest	8 Jul 202621:30	–	cvelist
EUVD	EUVD-2026-42443	8 Jul 202621:30	–	euvd
Friends Of PHP	symfony/ux-toolkit Path Traversal allows arbitrary file write and read via crafted recipe manifest	19 Jun 202607:21	–	friendsofphp
Github Security Blog	symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest	19 Jun 202621:42	–	github
NVD	CVE-2026-55878	8 Jul 202622:17	–	nvd
OSV	GHSA-P9XJ-FPR2-JF2Q symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest	19 Jun 202621:42	–	osv
Positive Technologies	PT-2026-51123	19 Jun 202600:00	–	ptsecurity
Snyk	Directory Traversal	19 Jun 202621:42	–	snyk
Vulnrichment	CVE-2026-55878 Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest	8 Jul 202621:30	–	vulnrichment

Vulners

Node

symfony ux_autocompleteRange2.32.0–2.36.1

symfony ux_autocompleteRange3.0.0–3.2.0

[
  {
    "vendor": "symfony",
    "product": "ux",
    "versions": [
      {
        "version": ">= 2.32.0, < 2.36.1",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0, < 3.2.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/symfony/ux/commit/7b4ddf3764bf269a1b5fde5bf03c4bce568694e4
github	www.github.com/symfony/ux/security/advisories/GHSA-p9xj-fpr2-jf2q
github	www.github.com/symfony/ux/releases/tag/v3.2.0
github	www.github.com/symfony/ux/releases/tag/v2.36.1

09 Jul 2026 15:16Current

6Medium risk

Vulners AI Score6

CVSS 3.17.8

SSVC

CWE-22