CVE-2026-82396: Php Symfony Unsafe Inline File Responsecve-2026-82396-php-symfony-unsafe-inline-file-response
Serving user files with a dynamic or inline Content-Disposition without setting a restrictive Content-Security-Policy header (e.g., 'sandbox') or resolving the disposition type safely can allow stored Cross-Site Scripting (XSS) if scriptable MIME types (e.g., HTML, XML) are rendered.
