Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
Description
Symfony routes can declare a requirements regex per path parameter, e.g. a route /{_locale}/blog with requirements: { _locale: 'en|fr|de' }. The Twig path() / url() helpers (backed by UrlGenerator) validate supplied parameter values against that regex before building the URL.
UrlGenerator constructs the validation pattern as '#^'.$req.'$#', where $req is the raw requirement string. For a requirement expressed as an alternation, e.g. _locale: 'ar|bg|...|vi|...|zh_CN' (very common), ^ and $ anchor only the first and last alternatives, so any middle alternative matches as an unanchored substring. A value like /evil.com satisfies the requirement (because it contains vi), and the generated path becomes //evil.com/...: a protocol-relative URL the browser navigates off-site.
Resolution
The UrlGenerator class now wraps the requirement in a non-capturing group so the ^ and $ anchors apply to the whole alternation.
The patch for this issue is available here for branch 5.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | symfony/routing | < 5.4.52, >= 6.0.0, < 6.4.40, >= 7.0.0, < 7.4.12, >= 8.0.0, < 8.0.12 | 5.4.52, 6.4.40, 7.4.12, 8.0.12 |
| Paquete de Composer | symfony/symfony | < 5.4.52, >= 6.0.0, < 6.4.40, >= 7.0.0, < 7.4.12, >= 8.0.0, < 8.0.12 | 5.4.52, 6.4.40, 7.4.12, 8.0.12 |
Referencias
- https://github.com/symfony/symfony/security/advisories/GHSA-72xp-p242-47p9
- https://github.com/symfony/symfony/commit/bcf487c22f3240ba994124e0e0fe8616f3cfc47a
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/routing/CVE-2026-45065.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45065.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45065
- Debilidad (CWE)
CWE-185, CWE-601- Plataforma
- Composer
- Paquete
symfony/routing, symfony/symfony- Publicada
- 27.05.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-72xp-p242-47p9 - CC BY 4.0
Historial de vulnerabilidades: symfony/routing
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 4
- Primera → última
- 05.2022 06.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 1
- Media 3
Divulgaciones por año
- 2022: 1
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 2
-
Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.