CVE-2026-45065
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
In Symfony prior to versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the UrlGenerator validates route parameters against a pattern built as ^ plus the raw requirement plus $, allowing values like //evil.com to satisfy a locale requirement and generate a protocol-relative off-site URL.
Risk Assessment
An attacker can exploit this vulnerability to generate links pointing to malicious domains, potentially leading to phishing or data leakage.
Recommendation
Update Symfony to versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 immediately, depending on the branch in use.
Other vulnerabilities in Symfony
See all- CVE-2016-4423High
The attemptAuthentication function in Symfony before versions 2.3.41, 2.7.13, 2.8.6, and 3.0.6 does not limit the length of a username stored in a session. This allows remote attackers to cause a denial of service through a series of authentication attempts with long, non-existent usernames.
- CVE-2016-1902High
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library, and the openssl_random_pseudo_bytes function fails.
- CVE-2013-1397High
Symfony versions 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x are vulnerable to remote attacks that allow arbitrary PHP code execution via a serialized PHP object in the Yaml::parse or Yaml\Parser::parse functions.
- CVE-2013-1348High
The Yaml::parse function in Symfony 2.0.x before version 2.0.22 allows remote attackers to execute arbitrary PHP code via a PHP file, which is a different vulnerability than CVE-2013-1397.
- CVE-2026-47767Critical
A vulnerability in Symfony allows an attacker to manipulate the APP_ENV and APP_DEBUG environment variables via a crafted query string that bypasses the protection introduced in CVE-2024-50340. The issue stems from a discrepancy between parse_str() and the web SAPI, enabling attacker-controlled --env or --no-debug flags to be passed to the script.
- CVE-2026-45069Critical
In Symfony up to versions 6.4.40, 7.4.12, and 8.0.12, the OidcTokenHandler::verifyClaims() method registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(). This allowed a validly signed JWT missing those claims to pass verification.
- CVE-2026-45063Critical
A vulnerability in Symfony X509Authenticator allows an attacker with a trusted certificate to impersonate a victim by placing emailAddress= in another RDN value, such as CN, due to an unanchored regex.
- CVE-2016-2403Critical
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
- CVE-2026-48784Medium
A vulnerability in Symfony allows an attacker to manipulate URL paths via controlled route parameters. The UrlGenerator::doGenerate() function uses strtr() dot-segment encoding that skips every other chained ../ or ./ segment, enabling generation of URLs that collapse to a different path under RFC 3986 normalization.
- CVE-2026-48761Medium
In Symfony PHP framework from 6.1.0 to 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs bypassed sanitization, allowing javascript: payloads. Fixed in versions 6.4.41, 7.4.13, and 8.0.13.
Original NVD description (English source)
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route parameters against a pattern built as ^ plus the raw requirement plus $; with ungrouped alternations, middle alternatives match as unanchored substrings, allowing a value such as //evil.com to satisfy a common locale requirement and generate a protocol-relative off-site URL. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.