CVE-2020-5274: Sensiolabs Symfony

Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days.

In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5

Affected products

• Sensiolabs Symfony: from 4.4.0, before 4.4.4 (fixed in 4.4.4); from 5.0.0, before 5.0.4 (fixed in 5.0.4)

Published 2020-03-30. Last modified 2026-06-17.