CVE-2026-118516— Symfony 路径访问控制绕过漏洞
一分钟漏洞结论
影响对象
sensiolabs symfony
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Symfony 路由组件中的 和 对主机名（host）和路径（path）信息的解析方式存在差异，导致在以下版本中基于路径的授权规则可能被绕过：Symfony 5.4 早于 5.4.56、6.x 早于 6.4.50、7.x 早于 7.4.23，以及 8.x 早于 8.1.11。 对于定义了主机名的路由， 会将字符串 与主机正则表达式及随后的路径正则表达式进行匹配；而 则分别独立匹配主机名和路径。因此，主机占位符可能匹配 并消耗路径的起始部分，导致请求被路由到某个控制器，而 却无法找到对应路由。诸如 条目和防火墙模式等
可能的 ATT&CK 技术 1 AI
T1190 · Exploit Public-Facing Application影响版本矩阵 4
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| sensiolabs | symfony | < 5.4.56 |
affected |
6.0.0< 6.4.50 |
affected | ||
7.0.0< 7.4.23 |
affected | ||
8.0.0< 8.1.11 |
affected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-118516 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
来源: CVE Program / CVE List V5
Vulnerability Description
The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
For routes that define a host, CompiledUrlMatcher matches the string $host.'.'.$pathinfo against the host regular expression followed by the path regular expression, while UrlMatcher matches the host and the path separately. A host placeholder can therefore match /, and consume the beginning of the path, so the request is routed to a controller, while UrlMatcher would find no route. Rules that look at the path, such as access_control entries and firewall patterns, are evaluated against the actual request path, so they do not apply while the controller of the route runs, potentially allowing an unauthenticated request to reach a protected controller. For example, with the route /admin/report/{id}, the host app.{domain} and the rule access_control: [{ path: ^/admin, roles: ROLE_ADMIN }], an anonymous request for /admin/report/1 is sent to the login page. A request with the Host header app and path /x./admin/report/1 instead reaches the controller, with domain="/x". With the required domain: .+, the real hostname works: app.example.com and /x./admin/report/1 match with domain="example.com./x".
Applications are affected if they have routes with host placeholders protected by path-based rules. With the default requirement, the Host header must be the host of the route without its last labels, such as app: framework.trusted_hosts blocks that, while a web server that only serves known names may not, for instance, Nginx passing the raw Host header to FastCGI for a request line that carries an absolute URI. If the requirement accepts /, such as .+, a real hostname works, and trusted_hosts does not help.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
解释冲突
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| sensiolabs | symfony | 0 ~ 5.4.56 | - |
|
二、漏洞 CVE-2026-118516 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-118516 的情报信息
请登录查看更多情报信息。
CVE-2026-118516 其他参考 (2)
-
https://github.com/symfony/symfony/security/advisories/GHSA-xqw3-x93m-887x third-party-advisory
同批安全公告 · sensiolabs · 2026-11-04 · 共 4 条
| CVE-2026-121971 | 8.2 HIGH | Symfony ScopingHttpClient 凭据跨域泄露漏洞 |
| CVE-2026-118513 | 7.7 HIGH | Symfony X.509 认证身份伪造漏洞（CVE-2026-45063 修复不全） |
| CVE-2026-121373 | 5.3 MEDIUM | Symfony HtmlSanitizer 反射标签漏洞 |