Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

symfony — Vulnerabilities & Security Advisories 53

All 53 CVE vulnerabilities found in symfony, with AI-generated Chinese analysis, references, and POCs.

This page aggregates Common Weakness Enumerations (CWE) specifically associated with the Symfony PHP framework, maintained by SensioLabs. It compiles a comprehensive dataset of security vulnerabilities affecting various versions and components of the Symfony ecosystem, covering advisory data from early releases up to the present day. Visitors can utilize this resource to track vendor-specific security advisories issued by SensioLabs and other relevant security entities, gain a deeper understanding of how specific weakness classes manifest within Symfony’s architecture, and examine the historical trend of vulnerabilities to assess long-term risk exposure. The collection includes details on affected versions, severity ratings, and remediation steps, providing a structured view of the security landscape for this popular web framework. By centralizing this information, the page serves as a vital reference for developers, security auditors, and IT administrators seeking to identify known issues, prioritize patching efforts, and improve the overall security posture of applications built on Symfony. This approach ensures that stakeholders have access to a clear, organized, and up-to-date overview of the product’s vulnerability history without the noise of unrelated data.

Vendor: symfony

CVE IDTitleCVSSSeverityPublished
CVE-2026-48761 Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content CWE-79--2026-07-14
CVE-2026-48747 Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade CWE-347--2026-07-14
CVE-2026-48489 Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes CWE-863--2026-07-14
CVE-2026-48760 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense CWE-451--2026-07-14
CVE-2026-48736 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient CWE-184--2026-07-14
CVE-2026-48784 Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization CWE-172--2026-07-14
CVE-2026-45068 Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address CWE-88--2026-07-14
CVE-2026-47212 Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection CWE-306--2026-07-14
CVE-2026-45071 Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true CWE-611--2026-07-14
CVE-2026-45755 Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection CWE-306--2026-07-14
CVE-2026-45754 Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection CWE-287--2026-07-14
CVE-2026-45305 Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex CWE-1333--2026-07-14
CVE-2026-45304 Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") CWE-776--2026-07-14
CVE-2026-45069 Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims CWE-345--2026-07-14
CVE-2026-45133 Symfony: [Yaml] Harden the parser when handling untrusted input CWE-674--2026-07-14
CVE-2026-45075 Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] CWE-863--2026-07-14
CVE-2026-47767 Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch CWE-436--2026-07-14
CVE-2026-45064 Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing CWE-451--2026-07-14
CVE-2026-45063 Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator CWE-290--2026-07-14
CVE-2026-45070 Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names CWE-93--2026-07-14
CVE-2026-45073 Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix CWE-89--2026-07-14
CVE-2026-45753 Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS) CWE-79--2026-07-14
CVE-2026-45072 Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering CWE-79--2026-07-14
CVE-2026-45756 Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS CWE-400--2026-07-14
CVE-2026-45066 Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification CWE-184--2026-07-14
CVE-2026-45074 Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay CWE-290--2026-07-14
CVE-2026-45077 Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener CWE-502--2026-07-14
CVE-2026-45065 Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection CWE-185--2026-07-14
CVE-2026-45067 Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address CWE-93--2026-07-14
CVE-2026-24739 Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operations CWE-88 6.3 Medium2026-01-28

All 53 known CVE vulnerabilities affecting symfony with full Chinese analysis, references, and POCs where available.