CVE-2026-121949— Symfony HtmlSanitizer 远程代码执行漏洞
一分钟漏洞结论
影响对象
sensiolabs symfony
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Symfony 的 HtmlSanitizer 组件未对 和 属性应用媒体 URL 策略，导致指向未被 或 允许的主机或协议的值能够绕过该策略。因此，在 Symfony 6.1.x（6.4.50 之前）、7.x（7.4.23 之前）以及 8.x（8.1.11 之前）版本中，浏览器会从被禁止的主机加载图像。 具体而言， 和 元素上的 属性，以及 元素上的 属性，虽然被净化器允许通过，但其包含的 URL 候选值从未得到验证。因此，这些属性的值会被原样保留，而相同 URL 若出现在 属性中则会被丢弃。此前针对 CVE-2
影响版本矩阵 3
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| sensiolabs | symfony | 6.1.0< 6.4.50 |
affected |
7.0.0< 7.4.23 |
affected | ||
8.0.0< 8.1.11 |
affected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-121949 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass
来源: CVE Program / CVE List V5
Vulnerability Description
The Symfony HtmlSanitizer component does not apply the media URL policy to the srcset and imagesrcset attributes, allowing values that point to hosts or schemes not permitted by allowMediaSchemes() or allowMediaHosts() to bypass it, so that browsers load images from disallowed hosts in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.The srcset attribute on img and source elements and the imagesrcset attribute on link elements are allowed by the sanitizer, but their URL candidates are never validated, so their values are kept verbatim while the same URL in src is dropped. The fixes for CVE-2026-45753 and CVE-2026-48761 extended the same attribute list but did not cover these two attributes. For example, with allowMediaSchemes(['https']) and allowMediaHosts(['trusted.example']), <img srcset="https://evil.example/a.png 1x"> survives sanitization, and the browser fetches the selected candidate as it would fetch src. Candidates with a scheme forbidden by the configuration, such as http, are kept as well.
Any application that sanitizes untrusted HTML and relies on the media schemes and hosts allowlists to restrict where images can be loaded from is affected. A single crafted value is enough to make the browser of a user viewing the sanitized content send a request to an attacker-controlled host, which can be used to track viewers or log their IP addresses. No authentication is needed if the application accepts HTML from unauthenticated users.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
不完整的黑名单
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| sensiolabs | symfony | 6.1.0 ~ 6.4.50 | - |
|
二、漏洞 CVE-2026-121949 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-121949 的情报信息
请登录查看更多情报信息。
CVE-2026-121949 其他参考 (2)
-
https://github.com/symfony/symfony/security/advisories/GHSA-q8jq-xrf4-v5j8 third-party-advisory
同批安全公告 · sensiolabs · 2026-11-05 · 共 4 条
| CVE-2026-123125 | 6.3 MEDIUM | Symfony IP 约束 SSRF 过滤绕过漏洞 |
| CVE-2026-123119 | 2.3 LOW | Symfony 4.4.53 远程代码执行漏洞 |
| CVE-2026-118517 | 2.3 LOW | Symfony HtmlSanitizer 链接媒体主机绕过漏洞 |