Description
Your Symfony web application is using a weak/predictable application secret (APP_SECRET).
An attacker can use this secret to potentially execute arbitrary PHP code using the ESI (Edge-Side Includes) functionality that is accessible at /_fragment.
Remediation
It's recommended to change the Symfony's application secret (APP_SECRET) to a long random string.
References
Related Vulnerabilities
Missing Authentication Check in SAP Solution Manager
WordPress Plugin Bricks Remote Code Execution (1.9.6)
XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-35152)
Drupal Core 7.x Remote Code Execution (7.0 - 7.73)
WordPress Plugin WP-Filebase Download Manager Remote Code Execution (0.3.0.03)