CVE-2026-48736
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A vulnerability in Symfony affects NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS by omitting IPv6 transition prefixes (such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6). This allows attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block.
Risk Assessment
The organization is at risk of bypassing network security controls, potentially leading to unauthorized access to internal network resources through crafted HTTP requests.
Recommendation
Immediately upgrade Symfony to version 5.4.53, 6.4.41, 7.4.13, or 8.0.13, depending on the branch in use, to remediate the vulnerability.
Other vulnerabilities in Symfony
See all- CVE-2016-4423High
The attemptAuthentication function in Symfony before versions 2.3.41, 2.7.13, 2.8.6, and 3.0.6 does not limit the length of a username stored in a session. This allows remote attackers to cause a denial of service through a series of authentication attempts with long, non-existent usernames.
- CVE-2016-1902High
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library, and the openssl_random_pseudo_bytes function fails.
- CVE-2013-1397High
Symfony versions 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x are vulnerable to remote attacks that allow arbitrary PHP code execution via a serialized PHP object in the Yaml::parse or Yaml\Parser::parse functions.
- CVE-2013-1348High
The Yaml::parse function in Symfony 2.0.x before version 2.0.22 allows remote attackers to execute arbitrary PHP code via a PHP file, which is a different vulnerability than CVE-2013-1397.
- CVE-2026-47767Critical
A vulnerability in Symfony allows an attacker to manipulate the APP_ENV and APP_DEBUG environment variables via a crafted query string that bypasses the protection introduced in CVE-2024-50340. The issue stems from a discrepancy between parse_str() and the web SAPI, enabling attacker-controlled --env or --no-debug flags to be passed to the script.
- CVE-2026-45069Critical
In Symfony up to versions 6.4.40, 7.4.12, and 8.0.12, the OidcTokenHandler::verifyClaims() method registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(). This allowed a validly signed JWT missing those claims to pass verification.
- CVE-2026-45063Critical
A vulnerability in Symfony X509Authenticator allows an attacker with a trusted certificate to impersonate a victim by placing emailAddress= in another RDN value, such as CN, due to an unanchored regex.
- CVE-2016-2403Critical
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
- CVE-2026-48784Medium
A vulnerability in Symfony allows an attacker to manipulate URL paths via controlled route parameters. The UrlGenerator::doGenerate() function uses strtr() dot-segment encoding that skips every other chained ../ or ./ segment, enabling generation of URLs that collapse to a different path under RFC 3986 normalization.
- CVE-2026-48761Medium
In Symfony PHP framework from 6.1.0 to 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs bypassed sanitization, allowing javascript: payloads. Fixed in versions 6.4.41, 7.4.13, and 8.0.13.
Original NVD description (English source)
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.