CVE-2026-123824 Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true

The Symfony Config component XmlUtils::parse enables DTD validation before rejecting documents that carry a doctype, allowing XML external entity XXE injection in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. A remote attacker who can supply...