Search for packages
| purl | pkg:composer/symfony/symfony@7.3.1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-3rg7-wf37-54rm
Aliases: CVE-2025-64500 |
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass ### Description The `Request` class improperly interprets some `PATH_INFO` … |
Vulnerable |
|
GHSA-38cx-cq6f-5755
Aliases: CVE-2026-48736 |
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient ### Description `Symfony\Component\HttpClient\NoPrivateNetworkHttpClient` is documented as … |
Vulnerable |
|
GHSA-v3wm-qf9p-c549
Aliases: CVE-2026-48760 |
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense ### Description `Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer::parse()` rejects … |
Vulnerable |
|
GHSA-6h46-9jf5-q59x
Aliases: CVE-2026-48489 |
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes ### Description When a firewall is configured … |
Vulnerable |
|
GHSA-h5x3-xfc9-m39h
Aliases: CVE-2026-48784 |
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization … |
Vulnerable |
|
GHSA-rrj9-5q2j-4gvr
Aliases: CVE-2026-48747 |
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade ### Description `Symfony\Component\Mailer\Bridge\Mailomat\Webhook\MailomatRequestParser::validateSignature()` parses the … |
Vulnerable |
|
GHSA-fqc7-9xjw-jrh3
Aliases: CVE-2026-47767 |
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch ### Description CVE-2024-50340 (GHSA-x8vp-gf4q-mw5j) addressed an … |
Vulnerable |
|
GHSA-x5qj-865h-mgvm
Aliases: CVE-2026-48761 |
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes ### Description `Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributes()` enumerates the attribute names whose values are scrubbed through `UrlSanitizer::sanitize()` (scheme … |
Vulnerable |
|
GHSA-64hg-93w9-fc35
Aliases: CVE-2026-45754 |
Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection ### Description The Mailjet mailer … |
Vulnerable |
|
GHSA-x6g4-fwcc-jj8w
Aliases: CVE-2026-45071 |
Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true ### Description `symfony/dom-crawler` provides the `Crawler` class for … |
Vulnerable |
|
GHSA-h5vq-qfcg-4m6p
Aliases: CVE-2026-45064 |
Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing ### Description `Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer::parse()` (used by `UrlSanitizer::sanitize()` and … |
Vulnerable |
|
GHSA-vqc8-7275-q272
Aliases: CVE-2026-45070 |
Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names ### Description `Symfony\Component\Mime\Header\ParameterizedHeader` (and the related parameter handling … |
Vulnerable |
|
GHSA-c2p3-7m5p-cv8x
Aliases: CVE-2026-45133 |
Symfony hardened the parser when handling untrusted input ### Description `Symfony\Component\Yaml\Parser` is the entry point for parsing YAML strings into … |
Vulnerable |
|
GHSA-4qpc-3hr4-r2p4
Aliases: CVE-2026-45304 |
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") ### Description `Symfony\Component\Yaml\Parser` resolves YAML aliases … |
Vulnerable |
|
GHSA-72xp-p242-47p9
Aliases: CVE-2026-45065 |
Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection ### Description Symfony routes can … |
Vulnerable |
|
GHSA-qpmx-3rfj-7rhv
Aliases: CVE-2026-45067 |
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address ### Description `Symfony\Component\Mime\Address` is the value-object every Symfony … |
Vulnerable |
|
GHSA-j8gj-9rm5-4xhx
Aliases: CVE-2026-45074 |
Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay `Cas2Handler` builds this `service` parameter from … |
Vulnerable |
|
GHSA-55rj-x2vc-4whq
Aliases: CVE-2026-47212 |
Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification ### Description The Twilio SMS notifier bridge … |
Vulnerable |
|
GHSA-xx3c-qf5g-hc39
Aliases: CVE-2026-45068 |
Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address ### Description Symfony Mailer selects a transport via the … |
Vulnerable |
|
GHSA-59f3-vp2f-mp9w
Aliases: CVE-2026-45755 |
Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection ### Description The Mailtrap mailer … |
Vulnerable |
|
GHSA-m7v2-7gxm-vc2v
Aliases: CVE-2026-45077 |
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener ### Description `Symfony\Bridge\Monolog\Command\ServerLogCommand` (the `server:log` console command) is a development-time … |
Vulnerable |
|
GHSA-6qh9-h6wf-jgqc
Aliases: CVE-2026-45073 |
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix ### Description `Symfony\Component\Cache\Adapter\PdoAdapter` is the PDO-backed cache adapter. Its `clear($prefix)` … |
Vulnerable |
|
GHSA-9frc-8383-795m
Aliases: CVE-2026-45305 |
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex ### Description `Symfony\Component\Yaml\Parser::cleanup()` strips the optional `%YAML` directive … |
Vulnerable |
|
GHSA-ph86-p8f6-f9r2
Aliases: CVE-2026-45063 |
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator ### Description `X509Authenticator` implements client-certificate (mTLS) authentication: the web … |
Vulnerable |
|
GHSA-hmr5-2xcr-v8pp
Aliases: CVE-2026-45072 |
Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering ### Description Symfony's profiler, a development only … |
Vulnerable |
|
GHSA-hhg7-c65m-h7ff
Aliases: CVE-2026-45753 |
Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS) ### Description `symfony/html-sanitizer` lets applications sanitise untrusted HTML. `UrlAttributeSanitizer` … |
Vulnerable |
|
GHSA-qc95-4862-92fh
Aliases: CVE-2026-45066 |
Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification ### Description `symfony/html-sanitizer` lets applications sanitise … |
Vulnerable |
|
GHSA-8v8v-g73j-492j
Aliases: CVE-2026-45756 |
Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS ### Description The `JsonPath` component's `match()` and `search()` … |
Vulnerable |
|
GHSA-r39x-jcww-82v6
Aliases: CVE-2026-24739 |
Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows ### Summary The Symfony Process … |
Vulnerable |
|
GHSA-2v3c-qxhr-7vpv
Aliases: CVE-2026-109413 |
Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process ### Description `Yaml\Parser::lexInlineStructure()` recursed through … |
Vulnerable |
|
GHSA-r925-mgvr-h9cc
Aliases: CVE-2026-108082 |
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header ### Description `HeaderUtils::split()` parsed header values with a pattern whose … |
Not vulnerable |