Description "symfony/dom-crawler" provides the "Crawler" class for navigating HTML/XML documents with CSS/XPath selectors; "symfony/browser-kit"'s "HttpBrowser" uses it to parse fetched pages. "Crawler::addXmlContent()" sets "DOMDocument::$validateOnParse = true" before calling "loadXML()". Setting "validateOnParse" re-enables libxml's DTD subset processing, including external entity resolution, even though "LIBXML_NONET" is passed. "LIBXML_NONET" blocks network fetches but not "file://" entities. An attacker-supplied XML document with a "SYSTEM "file:///etc/passwd"" entity is therefore expanded. Resolution The "Crawler::addXmlContent" method does not set the "validateOnParse" flag anymore. The patch for this issue is available "here" (https://github.com/symfony/symfony/commit/eea5fd7488cbdc241da4ce242344b7d9a3ecdf3d) for branch 5.4. Credits Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.