Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118516— Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control

Quick assessment

Affected
sensiolabs symfony
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Symfony 路由组件中的 和 对主机名（host）和路径（path）信息的解析方式存在差异，导致在以下版本中基于路径的授权规则可能被绕过：Symfony 5.4 早于 5.4.56、6.x 早于 6.4.50、7.x 早于 7.4.23，以及 8.x 早于 8.1.11。 对于定义了主机名的路由， 会将字符串 与主机正则表达式及随后的路径正则表达式进行匹配；而 则分别独立匹配主机名和路径。因此，主机占位符可能匹配 并消耗路径的起始部分，导致请求被路由到某个控制器，而 却无法找到对应路由。诸如 条目和防火墙模式等

CVSS 6.3 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 4

VendorProduct Version RangeStatus
sensiolabs symfony < 5.4.56 affected
6.0.0< 6.4.50 affected
7.0.0< 7.4.23 affected
8.0.0< 8.1.11 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118516

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
Source: CVE Program / CVE List V5
Vulnerability Description
The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. For routes that define a host, CompiledUrlMatcher matches the string $host.'.'.$pathinfo against the host regular expression followed by the path regular expression, while UrlMatcher matches the host and the path separately. A host placeholder can therefore  match /, and consume the beginning of the path, so the request is routed to a controller, while UrlMatcher  would find no route. Rules that look at the path, such as access_control entries and firewall patterns, are evaluated against the actual request path, so they do not apply while the controller of the route runs, potentially allowing an unauthenticated request to reach a protected controller. For example, with the route /admin/report/{id}, the host app.{domain} and the rule access_control: [{ path: ^/admin, roles: ROLE_ADMIN }], an anonymous request for /admin/report/1 is sent to the login page. A request with the Host header app and path /x./admin/report/1 instead reaches the controller, with domain="/x". With the required domain: .+, the real hostname works: app.example.com and /x./admin/report/1 match with domain="example.com./x". Applications are affected if they have routes with host placeholders protected by path-based rules. With the default requirement, the Host header must be the host of the route without its last labels, such as app: framework.trusted_hosts blocks that, while a web server that only serves known names may not, for instance, Nginx passing the raw Host header to FastCGI for a request line that carries an absolute URI. If the requirement accepts /, such as .+, a real hostname works, and trusted_hosts does not help.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
解释冲突
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sensiolabs symfony 0 ~ 5.4.56 -

II. Public POCs for CVE-2026-118516

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118516

请登录查看更多情报信息。

Other References for CVE-2026-118516 (2)

Same Patch Batch · sensiolabs · 2026-11-04 · 4 CVEs total

CVE-2026-121971 8.2 HIGH Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Thr
CVE-2026-118513 7.7 HIGH Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE
CVE-2026-121373 5.3 MEDIUM Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the B

IV. Related Vulnerabilities

Same product: symfony
Same vendor: sensiolabs
Same weakness: CWE-436