Skip to content

v2.0.3 — security patch (Symfony, Vite & Twig CVEs)

Choose a tag to compare

View all tags
@bun4uk bun4uk released this 18 Jun 17:15
v2.0.3
bc04383

Remediates all twelve Dependabot advisories reported against bun4uk/chadmin since v2.0.2, plus five Twig sandbox CVEs surfaced by composer audit. Dependency bumps only — no application behavior changes.

npm — vite 8.0.9 → 8.0.16

Severity Advisory Summary
high GHSA-fx2h-pf6j-xcff (CVE-2026-53571) server.fs.deny bypass on Windows alternate paths
medium GHSA-v6wh-96g9-6wx3 (CVE-2026-53632) launch-editor NTLMv2 hash disclosure via UNC path handling on Windows

composer — Symfony (→ 8.0.13 / 8.0.12)

Severity Advisory Package Summary
high GHSA-m7v2-7gxm-vc2v (CVE-2026-45077) symfony/monolog-bridge Unauthenticated PHP object deserialization in MonologBridge server:log listener
medium GHSA-38cx-cq6f-5755 (CVE-2026-48736) symfony/http-foundation IpUtils::PRIVATE_SUBNETS omits IPv6 transition forms → SSRF bypass in NoPrivateNetworkHttpClient
medium GHSA-6439-2f28-8p8q (CVE-2026-45075) symfony/http-kernel HEAD request bypasses methods: ['GET'] filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
medium GHSA-6qh9-h6wf-jgqc (CVE-2026-45073) symfony/cache SQL injection in PdoAdapter::doClear() via unsanitized $prefix
low GHSA-hmr5-2xcr-v8pp (CVE-2026-45072) symfony/web-profiler-bundle Stored XSS in CodeExtension::fileExcerpt() (unescaped non-PHP file rendering)
low GHSA-c2p3-7m5p-cv8x (CVE-2026-45133) symfony/yaml Parser hardening when handling untrusted input
low GHSA-4qpc-3hr4-r2p4 (CVE-2026-45304) symfony/yaml Exponential memory allocation via recursive collection-alias
low GHSA-9frc-8383-795m (CVE-2026-45305) symfony/yaml ReDoS via catastrophic backtracking in Parser::cleanup() regex

symfony/routing and symfony/http-kernel are also bumped to 8.0.13 transitively. The Symfony tree is re-resolved to the latest 8.0.x to honor the project's ~8.0.0 constraint.

composer — Twig twig/twig 3.26.0 → 3.27.1

Surfaced by composer audit (not yet flagged by Dependabot). Five sandbox-bypass advisories, all fixed in 3.27.0:

  • CVE-2026-48808 — sandbox property allowlist bypass via the column filter under SourcePolicyInterface
  • CVE-2026-48807 — sandbox __toString() policy bypass via Traversable in join/replace and in/not in
  • CVE-2026-48806 — sandbox __toString() policy bypass via dynamic mapping keys
  • CVE-2026-48805 — sandbox state regression in deprecated internal wrappers
  • CVE-2026-46636 — sandbox filter/tag/function allow-list bypass when sandbox state changes between renders

Notes

Chadmin renders only its own first-party Twig templates and does not use the Twig sandbox, so the sandbox CVEs are not exploitable here — the bump keeps composer audit and Docker image scanners green. composer audit --locked reports no advisories. Also includes a demo fix: the elapsed-time counter no longer stops incrementing.

Images

  • Docker Hub: docker pull bun4uk/chadmin:2.0.3 (also 2.0, 2, latest)
  • GHCR: docker pull ghcr.io/bun4uk/chadmin:2.0.3
Assets 2
Loading