CVE-2026-118517 (GCVE-0-2026-118517)
Vulnerability from cvelistv5 – Published: 2026-11-05 16:26 – Updated: 2026-11-05 16:52
VLAI
EPSS
VEX
Title
Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)
Summary
The Symfony HtmlSanitizer component UrlSanitizer parses URLs differently from browsers, allowing the allowLinkHosts() and allowMediaHosts() checks to be bypassed for URLs without a well-formed authority, resulting in untrusted hosts being referenced in sanitized output in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
UrlSanitizer parses URLs with league/uri, which follows RFC 3986, while browsers follow the WHATWG URL standard. For URLs without a well-formed authority, such as http:evil.example, ///evil.example, or https://://evil.example/ the sanitizer finds no host, whereas browsers resolve them to evil.example. The guard added for CVE-2026-45066 missed the zero-slash form, and the host 0 was also skipped because PHP treats it as falsy.
This is exploitable when a host allow-list is combined with allowRelativeLinks(true) or allowRelativeMedias(true). The default configuration is not affected.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 16:49 UTC
Assigner
Checkmarx
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/symfony/symfony/security/advis… | third-party-advisory |
| https://github.com/symfony/symfony/commit/f2f47d2… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sensiolabs | symfony |
Affected:
6.1.0 , < 6.4.50
(git)
Affected: 7.0.0 , < 7.4.23 (git) Affected: 8.0.0 , < 8.1.11 (git) cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-118517",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T16:49:56.410466Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T16:52:28.063Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/packages/symfony/http-client",
"defaultStatus": "unaffected",
"modules": [
"Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer"
],
"packageName": "symfony/http-client",
"product": "symfony",
"repo": "https://github.com/symfony/http-client",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "6.4.50",
"status": "affected",
"version": "6.1.0",
"versionType": "git"
},
{
"lessThan": "7.4.23",
"status": "affected",
"version": "7.0.0",
"versionType": "git"
},
{
"lessThan": "8.1.11",
"status": "affected",
"version": "8.0.0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.50",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.4.23",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.1.11",
"versionStartIncluding": "8.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Nicolas Grekas"
},
{
"lang": "en",
"type": "reporter",
"value": "Ilia Alshanetsky"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Symfony HtmlSanitizer component \u003ccode\u003eUrlSanitizer\u003c/code\u003e\u0026nbsp;parses URLs differently from browsers, allowing\u0026nbsp;\u003cspan\u003ethe \u003c/span\u003e\u003ccode\u003eallowLinkHosts()\u003c/code\u003e\u003cspan\u003e and \u003c/span\u003e\u003ccode\u003eallowMediaHosts()\u003c/code\u003e\u003cspan\u003e checks to be bypassed for URLs without a well-formed authority,\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003eresulting in untrusted hosts being referenced in sanitized output\u003cspan\u003e\u0026nbsp;in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003ccode\u003eUrlSanitizer\u003c/code\u003e\u003cspan\u003e parses URLs with \u003c/span\u003e\u003ccode\u003eleague/uri\u003c/code\u003e\u003cspan\u003e, which follows RFC 3986, while browsers follow the WHATWG URL standard.\u0026nbsp;\u003c/span\u003eFor URLs without a well-formed authority, such as \u003ccode\u003ehttp:evil.example\u003c/code\u003e, \u003ccode\u003e///evil.example\u003c/code\u003e, or \u003ccode\u003ehttps://://evil.example/\u0026nbsp;\u003c/code\u003et\u003cspan\u003ehe sanitizer finds no host, whereas browsers resolve them to \u003c/span\u003e\u003ccode\u003eevil.example\u003c/code\u003e\u003cspan\u003e. The guard added for CVE-2026-45066 missed the zero-slash form, and the host \u003c/span\u003e\u003ccode\u003e0\u003c/code\u003e\u003cspan\u003e was also skipped because PHP treats it as falsy.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThis is exploitable when a host allow-list is combined with \u003c/span\u003e\u003ccode\u003eallowRelativeLinks(true)\u003c/code\u003e\u003cspan\u003e or \u003c/span\u003e\u003ccode\u003eallowRelativeMedias(true)\u003c/code\u003e\u003cspan\u003e. The default configuration is not affected.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "The Symfony HtmlSanitizer component UrlSanitizer\u00a0parses URLs differently from browsers, allowing\u00a0the allowLinkHosts() and allowMediaHosts() checks to be bypassed for URLs without a well-formed authority,\u00a0resulting in untrusted hosts being referenced in sanitized output\u00a0in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\n\n\nUrlSanitizer parses URLs with league/uri, which follows RFC 3986, while browsers follow the WHATWG URL standard.\u00a0For URLs without a well-formed authority, such as http:evil.example, ///evil.example, or https://://evil.example/\u00a0the sanitizer finds no host, whereas browsers resolve them to evil.example. The guard added for CVE-2026-45066 missed the zero-slash form, and the host 0 was also skipped because PHP treats it as falsy.\n\n\n\nThis is exploitable when a host allow-list is combined with allowRelativeLinks(true) or allowRelativeMedias(true). The default configuration is not affected."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-184",
"description": "CWE-184 Incomplete List of Disallowed Inputs",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436 Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T16:26:52.166Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-c76g-9c4c-gxrw"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/commit/f2f47d2eef6c2552c6c5c24953caa94f7901cb43"
}
],
"source": {
"advisory": "GHSA-c76g-9c4c-gxrw",
"discovery": "UNKNOWN"
},
"title": "Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-118517",
"datePublished": "2026-11-05T16:26:52.166Z",
"dateReserved": "2026-10-28T14:33:36.992Z",
"dateUpdated": "2026-11-05T16:52:28.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-118517",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T16:49:56.410466Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T16:49:01.047Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/packages/symfony/http-client",
"defaultStatus": "unaffected",
"modules": [
"Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer"
],
"packageName": "symfony/http-client",
"product": "symfony",
"repo": "https://github.com/symfony/http-client",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "6.4.50",
"status": "affected",
"version": "6.1.0",
"versionType": "git"
},
{
"lessThan": "7.4.23",
"status": "affected",
"version": "7.0.0",
"versionType": "git"
},
{
"lessThan": "8.1.11",
"status": "affected",
"version": "8.0.0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.50",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.4.23",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.1.11",
"versionStartIncluding": "8.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Nicolas Grekas"
},
{
"lang": "en",
"type": "reporter",
"value": "Ilia Alshanetsky"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Symfony HtmlSanitizer component \u003ccode\u003eUrlSanitizer\u003c/code\u003e\u0026nbsp;parses URLs differently from browsers, allowing\u0026nbsp;\u003cspan\u003ethe \u003c/span\u003e\u003ccode\u003eallowLinkHosts()\u003c/code\u003e\u003cspan\u003e and \u003c/span\u003e\u003ccode\u003eallowMediaHosts()\u003c/code\u003e\u003cspan\u003e checks to be bypassed for URLs without a well-formed authority,\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003eresulting in untrusted hosts being referenced in sanitized output\u003cspan\u003e\u0026nbsp;in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003ccode\u003eUrlSanitizer\u003c/code\u003e\u003cspan\u003e parses URLs with \u003c/span\u003e\u003ccode\u003eleague/uri\u003c/code\u003e\u003cspan\u003e, which follows RFC 3986, while browsers follow the WHATWG URL standard.\u0026nbsp;\u003c/span\u003eFor URLs without a well-formed authority, such as \u003ccode\u003ehttp:evil.example\u003c/code\u003e, \u003ccode\u003e///evil.example\u003c/code\u003e, or \u003ccode\u003ehttps://://evil.example/\u0026nbsp;\u003c/code\u003et\u003cspan\u003ehe sanitizer finds no host, whereas browsers resolve them to \u003c/span\u003e\u003ccode\u003eevil.example\u003c/code\u003e\u003cspan\u003e. The guard added for CVE-2026-45066 missed the zero-slash form, and the host \u003c/span\u003e\u003ccode\u003e0\u003c/code\u003e\u003cspan\u003e was also skipped because PHP treats it as falsy.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThis is exploitable when a host allow-list is combined with \u003c/span\u003e\u003ccode\u003eallowRelativeLinks(true)\u003c/code\u003e\u003cspan\u003e or \u003c/span\u003e\u003ccode\u003eallowRelativeMedias(true)\u003c/code\u003e\u003cspan\u003e. The default configuration is not affected.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "The Symfony HtmlSanitizer component UrlSanitizer\u00a0parses URLs differently from browsers, allowing\u00a0the allowLinkHosts() and allowMediaHosts() checks to be bypassed for URLs without a well-formed authority,\u00a0resulting in untrusted hosts being referenced in sanitized output\u00a0in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\n\n\nUrlSanitizer parses URLs with league/uri, which follows RFC 3986, while browsers follow the WHATWG URL standard.\u00a0For URLs without a well-formed authority, such as http:evil.example, ///evil.example, or https://://evil.example/\u00a0the sanitizer finds no host, whereas browsers resolve them to evil.example. The guard added for CVE-2026-45066 missed the zero-slash form, and the host 0 was also skipped because PHP treats it as falsy.\n\n\n\nThis is exploitable when a host allow-list is combined with allowRelativeLinks(true) or allowRelativeMedias(true). The default configuration is not affected."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-184",
"description": "CWE-184 Incomplete List of Disallowed Inputs",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436 Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T16:26:52.166Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-c76g-9c4c-gxrw"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/commit/f2f47d2eef6c2552c6c5c24953caa94f7901cb43"
}
],
"source": {
"advisory": "GHSA-c76g-9c4c-gxrw",
"discovery": "UNKNOWN"
},
"title": "Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-118517",
"datePublished": "2026-11-05T16:26:52.166Z",
"dateReserved": "2026-10-28T14:33:36.992Z",
"dateUpdated": "2026-11-05T16:52:28.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.