Iniciar sesión
Deutsch English Español Polski
Media

Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

  • Publicada: 27.05.2026
  • Actualizado: 11.10.2026 10:22

Description

symfony/html-sanitizer lets applications sanitise untrusted HTML. The configuration methods allowLinkHosts([...]) and allowLinkSchemes([...]) are intended to restrict <a href> targets to an allowlist of hosts/schemes; allowMediaHosts() / allowMediaSchemes() do the same for <img src> etc.

Three distinct bypasses allow a content author to smuggle off-allowlist URLs past these checks. First, UrlSanitizer::parse() parses the input following RFC-3986, while browsers follow the WHATWG URL Standard which normalises \ to / before parsing the authority of "special" schemes; so an input like https://evil\@trusted.com/ parses with host trusted.com server-side but navigates to https://evil/ in the browser. Second, WHATWG collapses any run of / after the scheme into //, while RFC-3986 does not; so https:/evil.com/ and https:///evil.com/ parse as host-less (skipping the host allowlist) but resolve to evil.com in the browser. Third, UrlAttributeSanitizer checks 'a' === $element to route to the link policy and falls through to the media policy otherwise, but <area> is a navigable hyperlink equivalent to <a>; so <area href> was sanitised against the media policy (which typically allows data: and may have no host allowlist), bypassing allowLinkHosts() / allowLinkSchemes() entirely.

Resolution

UrlSanitizer::sanitize() now rejects URLs that contain a backslash or that use a special scheme (http, https, ftp, ws, wss) followed by a single slash or three slashes before parsing, eliminating the parser-differential bypasses. UrlAttributeSanitizer now applies the link policy to both <a> and <area> elements.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer symfony/html-sanitizer >= 6.1.0, < 6.4.40, >= 7.0.0, < 7.4.12, >= 8.0.0, < 8.0.12 6.4.40, 7.4.12, 8.0.12
Paquete de Composer symfony/symfony >= 6.1.0, < 6.4.40, >= 7.0.0, < 7.4.12, >= 8.0.0, < 8.0.12 6.4.40, 7.4.12, 8.0.12

Referencias

Puntuación CVSS -
Debilidad (CWE)
CWE-184, CWE-436
Plataforma
Composer
Paquete
symfony/html-sanitizer, symfony/symfony
Publicada
27.05.2026
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-qc95-4862-92fh - CC BY 4.0

Historial de vulnerabilidades: symfony/symfony

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (100) en el archivo
Entradas en total
100
Primera → última
11.2019 06.2026
Sin corrección
0
Explotada en ataques
0

Distribución por gravedad

  • Crítica 8
  • Alta 28
  • Media 51
  • Baja 13

Divulgaciones por año

Gravedad:
  1. Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
    Alta CVE-2026-48489 < 5.4.53, >= 6.0.0, < 6.4.41, >= 7.0.0, < 7.4.13, >= 8.0.0, < 8.0.13 5.4.53, 6.4.41, 7.4.13, 8.0.13
  2. Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
    Alta CVE-2026-45077 < 5.4.52, >= 6.0.0, < 6.4.40, >= 7.0.0, < 7.4.12, >= 8.0.0, < 8.0.12 5.4.52, 6.4.40, 7.4.12, 8.0.12
  3. Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
    Alta CVE-2026-45075 >= 7.4.0, < 7.4.12, >= 8.0.0, < 8.0.12 7.4.12, 8.0.12
  4. Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
    Alta CVE-2026-45067 < 5.4.52, >= 6.0.0, < 6.4.40, >= 7.0.0, < 7.4.12, >= 8.0.0, < 8.0.12 5.4.52, 6.4.40, 7.4.12, 8.0.12
  5. Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification esta entrada
    Media CVE-2026-45066 >= 6.1.0, < 6.4.40, >= 7.0.0, < 7.4.12, >= 8.0.0, < 8.0.12 6.4.40, 7.4.12, 8.0.12
  6. Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
    Alta CVE-2026-45063 < 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12 5.4.52, 6.4.40, 7.4.12, 8.0.12
  7. Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
    Alta · 7.3 CVE-2025-64500 >= 2.0.0, < 5.4.50, >= 6.0.0, < 6.4.29, >= 7.0.0, < 7.3.7 5.4.50, 6.4.29, 7.3.7
  8. Symfony vulnerable to command execution hijack on Windows with Process class
    Alta · 8.4 CVE-2024-51736 < 5.4.46, >= 6.0.0, < 6.4.14, >= 7.0.0, < 7.1.7 5.4.46, 6.4.14, 7.1.7
  9. Symfony Cross-Site Request Forgery vulnerability in the Web Profiler
    Alta · 8.1 CVE-2014-6072 >= 2.0.0, < 2.3.19, >= 2.4.0, < 2.4.9, >= 2.5.0, < 2.5.4 2.3.19, 2.4.9, 2.5.4
  10. Symfony XML Entity Expansion security vulnerability
    Alta · 7.5 ghsa-q2gc-gg3x-7942 >= 2.0.0, < 2.0.17 2.0.17
  11. Symfony XML decoding attack vector through external entities
    Crítica · 9.8 ghsa-mmcv-fvq8-r9x3 >= 2.0.0, < 2.0.11 2.0.11
  12. Symfony allows direct access of ESI URLs behind a trusted proxy
    Alta · 7.5 CVE-2014-5245 >= 2.0.0, < 2.3.19, >= 2.4.0, < 2.4.9, >= 2.5.0, < 2.5.4 2.3.19, 2.4.9, 2.5.4
  13. Symfony vulnerable to denial of service via a malicious HTTP Host header
    Alta · 7.5 CVE-2014-5244 >= 2.0.0, < 2.3.19, >= 2.4.0, < 2.4.9, >= 2.5.0, < 2.5.4 2.3.19, 2.4.9, 2.5.4
  14. Code injection in the way Symfony implements translation caching in FrameworkBundle
    Alta · 7.5 CVE-2014-4931 >= 2.0.0, < 2.3.19, >= 2.4.0, < 2.4.9, >= 2.5.0, < 2.5.4 2.3.19, 2.4.9, 2.5.4
  15. Symfony Incorrect Access Control
    Crítica · 9.8 CVE-2017-11365 >= 2.7.30, < 2.7.32, >= 2.8.23, < 2.8.25, >= 3.2.10, < 3.2.12, >= 3.3.3, < 3.3.5 2.7.32, 2.8.25, 3.2.12, 3.3.5
  16. Symphony Denial of Service Via Overlong Usernames
    Alta · 7.5 CVE-2016-4423 >= 2.3.0, < 2.3.41, >= 2.4.0, < 2.7.13, >= 2.8.0, < 2.8.6, >= 3.0.0, < 3.0.6 2.3.41, 2.7.13, 2.8.6, 3.0.6
  17. Symfony Cryptographic Vulnerability
    Alta · 7.5 CVE-2016-1902 >= 2.3.0, < 2.3.37, >= 2.4.0, < 2.6.13, >= 2.7.0, < 2.7.9 2.3.37, 2.6.13, 2.7.9
  18. Symfony Vulnerable to Timing Attack
    Alta CVE-2015-8125 >= 2.3.0, < 2.3.35, >= 2.7.0, < 2.7.7, >= 2.4.0, < 2.6.12 2.3.35, 2.7.7, 2.6.12
  19. Symphony Vulnerable to PHP Code Injection via YAML Parsing
    Alta CVE-2013-1348 >= 2.0.0, < 2.0.22 2.0.22
  20. Symfony Arbitrary PHP code Execution
    Alta CVE-2013-1397 >= 2.2.0-BETA1, < 2.2.0-BETA2, >= 2.0.0, < 2.0.22, >= 2.1.0, < 2.1.7 2.2.0-BETA2, 2.0.22, 2.1.7
  21. Symfony Authentication Bypass
    Crítica · 9.8 CVE-2018-11407 >= 2.8.0, < 2.8.37, >= 3.0.0, < 3.3.17, >= 3.4.0, < 3.4.7, >= 4.0.0, < 4.0.7 2.8.37, 3.3.17, 3.4.7, 4.0.7
  22. Symfony Authentication Bypass
    Crítica · 9.8 CVE-2016-2403 >= 2.8.0, < 2.8.6, >= 3.0.0, < 3.0.6 2.8.6, 3.0.6
  23. Symfony Host Header Injection
    Alta · 7.2 CVE-2018-14774 >= 2.7.0, < 2.7.49, >= 2.8.0, < 2.8.44, >= 3.3.0, < 3.3.18, >= 3.4.0, < 3.4.14, >= 4.0.0, < 4.0.14, >= 4.1.0, < 4.1.3 2.7.49, 2.8.44, 3.3.18, 3.4.14, 4.0.14, 4.1.3
  24. Symfony Session Fixation Vulnerability
    Alta · 8.1 CVE-2018-11385 >= 2.7.0, < 2.7.48, >= 2.8.0, < 2.8.41, >= 3.0.0, < 3.3.17, >= 3.4.0, < 3.4.11, >= 4.0.0, < 4.0.11 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11
  25. Symfony Directory Traversal
    Alta · 7.5 CVE-2017-16654 >= 2.7.0, < 2.7.38, >= 2.8.0, < 2.8.31, >= 3.0.0, < 3.2.14, >= 3.3.0, < 3.3.13 2.7.38, 2.8.31, 3.2.14, 3.3.13
  26. Symfony CSRF Token Fixation
    Alta · 8.8 CVE-2018-11406 >= 2.7.0, < 2.7.48, >= 2.8.0, < 2.8.41, >= 3.0.0, < 3.3.17, >= 3.4.0, < 3.4.11, >= 4.0.0, < 4.0.11 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11
  27. Symfony collectionCascaded and collectionCascadedDeeply fields security bypass
    Alta · 8.1 CVE-2013-4751 >= 2.0.0, < 2.0.24, >= 2.1.0, < 2.1.12, >= 2.2.0, < 2.2.5, >= 2.3.0, < 2.3.3 2.0.24, 2.1.12, 2.2.5, 2.3.3
  28. Symfony Http-Kernel has non-constant time comparison in UriSigner
    Alta · 8.1 CVE-2019-18887 >= 2.2.0, < 2.8.52, >= 3.0.0, < 3.4.35, >= 4.0.0, < 4.2.12, >= 4.3.0, < 4.3.8 2.8.52, 3.4.35, 4.2.12, 4.3.8
  29. RCE in Symfony
    Alta · 8.0 CVE-2020-15094 >= 4.3.0, < 4.4.13, >= 5.0.0, < 5.1.5 4.4.13, 5.1.5
  30. Firewall configured with unanimous strategy was not actually unanimous in Symfony
    Alta · 7.6 CVE-2020-5275 >= 4.4.0, < 4.4.7, >= 5.0.0, < 5.0.7 4.4.7, 5.0.7
  31. Improper authentication in Symfony
    Alta · 7.5 CVE-2019-10911 >= 2.7.0, < 2.7.51, >= 2.8.0, < 2.8.50, >= 3.0.0, < 3.4.26, >= 4.0.0, < 4.1.12, >= 4.2.0, < 4.2.7 2.7.51, 2.8.50, 3.4.26, 4.1.12, 4.2.7
  32. Deserialization of untrusted data in Symfony
    Alta · 7.1 CVE-2019-10912 >= 2.8.0, < 2.8.50, >= 3.0.0, < 3.4.26, >= 4.0.0, < 4.1.12, >= 4.2.0, < 4.2.7 2.8.50, 3.4.26, 4.1.12, 4.2.7
  33. Improper Input Validation in Symfony
    Crítica · 9.8 CVE-2019-11325 >= 4.2.0, < 4.2.12, >= 4.3.0, < 4.3.8 4.2.12, 4.3.8
  34. Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
    Crítica · 9.8 CVE-2019-10913 >= 2.7.0, < 2.7.51, >= 2.8.0, < 2.8.50, >= 3.0.0, < 3.4.26, >= 4.0.0, < 4.1.12, >= 4.2.0, < 4.2.7 2.7.51, 2.8.50, 3.4.26, 4.1.12, 4.2.7
  35. Argument injection in a MimeTypeGuesser in Symfony
    Alta · 7.5 CVE-2019-18888 >= 2.0.0, < 2.8.52, >= 3.0.0, < 3.4.35, >= 4.0.0, < 4.2.12, >= 4.3.0, < 4.3.8 2.8.52, 3.4.35, 4.2.12, 4.3.8
  36. Symfony Unsafe Cache Serialization Could Enable RCE
    Crítica · 9.8 CVE-2019-18889 >= 3.1.0, < 3.4.35, >= 4.0.0, < 4.2.12, >= 4.3.0, < 4.3.8 3.4.35, 4.2.12, 4.3.8
  37. Symfony Service IDs Allow Injection
    Crítica · 9.8 CVE-2019-10910 >= 2.7.0, < 2.7.51, >= 2.8.0, < 2.8.50, >= 3.0.0, < 3.4.26, >= 4.0.0, < 4.1.12, >= 4.2.0, < 4.2.7 2.7.51, 2.8.50, 3.4.26, 4.1.12, 4.2.7

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.