SEC.co
Emergency
HIGH 7.8

CVE-2026-55878: Symfony UX Path Traversal in ux:install Command

Symfony UX, a JavaScript framework for Symfony developers, contains a path traversal vulnerability in its ux:install command. When installing recipe kits, the command copies files based on a list provided by the kit. An attacker who creates a malicious kit or compromises an existing one can exploit insufficient path validation to write files anywhere on the system or read sensitive files outside the intended recipe directory. The vulnerability affects versions 2.32.0 through 2.36.0 and 3.0.0 through 3.1.x, and is resolved in versions 2.36.1 and 3.2.0.

Source data · NVD / CISA · public domain

CVSS
3.1 · 7.8 HIGH · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses (CWE)
CWE-22
Affected products
0 configuration(s)
Published / Modified
2026-07-08 / 2026-07-10

NVD description (verbatim)

Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative() accepts paths like ../../../etc, a crafted or compromised kit can write attacker-controlled content to arbitrary locations or read local files outside the recipe directory. This issue is fixed in versions 2.36.1 and 3.2.0.

4 reference(s) · View on NVD →

SEC.co analysis · AI-assisted, reviewed against source

Technical summary

The ux:install command processes a copy-files map from recipe kits without properly validating relative path traversal sequences. Specifically, Path::isRelative() fails to reject paths containing traversal patterns like ../../../etc. This allows a malicious or compromised kit to specify arbitrary filesystem locations as copy destinations or sources. The vulnerability stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and requires local access but can execute with user privileges during the install process.

Business impact

Development teams using affected Symfony UX versions face risk when installing recipe kits during development or deployment workflows. A compromised kit could inject malicious code into the application codebase, modify configuration files, steal environment secrets, or corrupt system files if the install command runs with elevated privileges. This could lead to application compromise, data theft, or supply-chain contamination if malicious kits are distributed through compromised or untrusted sources.

Affected systems

Symfony UX versions 2.32.0 through 2.36.0 (inclusive) and 3.0.0 through 3.1.x are vulnerable. The vulnerability requires execution of the ux:install console command, typically during development setup or automated deployment pipelines. Organizations running Symfony-based applications that use UX components are affected if they have not yet updated to the patched versions.

Exploitability

Exploitation requires local code execution context and user interaction to run the ux:install command with a malicious or compromised recipe kit. The CVSS score of 7.8 (HIGH) reflects high impact across confidentiality, integrity, and availability, combined with low attack complexity. The attack vector is local and does not require elevated privileges, but relies on social engineering or supply-chain compromise to deliver a malicious kit. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Update Symfony UX to version 2.36.1 or later (for the 2.x branch) or version 3.2.0 or later (for the 3.x branch). Before updating, audit any recipe kits installed in recent deployments, especially from untrusted or newly-added sources. Verify the integrity of kit sources and consider restricting ux:install execution to controlled environments with sandboxing or code review processes.

Patch guidance

Apply updates immediately to development and deployment pipelines. For organizations on Symfony UX 2.x, upgrade to 2.36.1 or a later 2.x release. For those on 3.x, upgrade to 3.2.0 or later. Test recipe kit installations in a non-production environment post-patch to confirm compatibility. If automatic updates are in use, prioritize this patch to prevent opportunistic exploitation during future kit installations.

Detection guidance

Monitor for ux:install command execution with unusual or unfamiliar recipe kits. Audit filesystem changes following recipe installation, particularly writes to directories outside the project root. Review logs for path traversal patterns (../ sequences) in kit configuration files or copy-files maps. Inspect the contents of recipe directories for unexpected files or modifications in system-critical paths. Consider implementing file integrity monitoring on directories where ux:install operates.

Why prioritize this

This vulnerability merits priority remediation due to its HIGH CVSS score, the ease with which malicious kits can be distributed or intercepted, and its position in the development-to-deployment pipeline where it can affect multiple downstream applications. Although not yet actively exploited according to KEV data, the attack surface spans development teams and CI/CD systems, increasing organizational risk.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects: (1) Local attack vector requiring command execution; (2) Low attack complexity—no special conditions needed beyond a malicious kit; (3) No privilege escalation required; (4) High impact on confidentiality (files can be read), integrity (files can be written), and availability (system files could be corrupted). The score does not account for supply-chain or social-engineering prerequisites, which may increase practical risk in open-source environments.

Frequently asked questions

Can this vulnerability be exploited remotely?

No. The vulnerability requires local code execution and user interaction to run the ux:install command. However, if a malicious kit is distributed through a compromised repository or man-in-the-middle attack, attackers could trick developers into executing it, which is a form of remote supply-chain compromise.

Do I need elevated privileges to exploit this?

No. The vulnerability executes with the privileges of the user running the ux:install command. If that user is a developer with standard permissions, the attacker gains those same permissions. If the command runs in a CI/CD pipeline under a service account with elevated access, the risk increases significantly.

How can we detect if our systems were compromised by a malicious kit?

Audit the filesystem for unexpected files created outside your project directory, review audit logs for ux:install commands and their parameters, inspect kit source repositories for unauthorized changes, and cross-reference file modification timestamps with known installation times. Integrity checks on sensitive directories (system binaries, configuration files) can reveal suspicious writes.

Does updating Symfony UX automatically fix compromised kits?

Updating Symfony UX patches the vulnerability and prevents future exploitation, but it does not remediate damage already caused by a previously-installed malicious kit. You must audit and clean any affected systems independently of patching.

This analysis is provided for informational purposes and reflects the state of the CVE as of the publication date. Security assessments should be tailored to your specific environment and risk posture. Verify all patch version numbers and compatibility with your deployment before applying updates. SEC.co does not provide exploit code or detailed attack methodologies. Consult official Symfony security advisories and vendor documentation for authoritative guidance. This vulnerability is not currently listed as actively exploited by CISA, but organizations should prioritize patching based on their exposure to untrusted recipe kits and development practices. Source: NVD (public-domain), retrieved 2026-08-17. Analysis generated by SEC.co (claude-haiku-4-5).

Weaknesses (CWE)

CWE-22

Related vulnerabilities