CVE-2026-123125
Received Received - Intake

Server-Side Request Forgery in Symfony IpValidator

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Checkmarx

Description
The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. In these modes, IpValidator relies on the PHP flags FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE to classify addresses as public, private, or reserved. These flags do not cover shared address space (100.64.0.0/10) or IPv4-mapped, IPv4-compatible, and 6to4 IPv6 addresses, which can embed internal IPv4 addresses. A value such as ::ffff:127.0.0.1 can therefore pass validation even though it points to an internal host. Applications that rely on the Ip constraint to reject internal addresses, for example before making a server-side request to a user-supplied address, can be exposed to SSRF.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-123125
EUVD
EUVD-2026-117557

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
sensiolabs symfony 0
sensiolabs symfony 6.0.0
sensiolabs symfony 7.0.0
sensiolabs symfony 8.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the Symfony framework's IpValidator component. It occurs because the validator incorrectly classifies certain internal IP addresses as public, allowing attackers to bypass security checks. The issue stems from the validator relying on incomplete PHP flags that miss specific address ranges like shared address space (100.64.0.0/10) or IPv4-mapped IPv6 addresses. This enables attackers to trick applications into making unauthorized server-side requests to internal hosts.

Detection Guidance

To detect this vulnerability, inspect Symfony applications using the IpValidator component for versions prior to 5.4.56, 6.4.50, 7.4.23, or 8.1.11. Check if the application processes user-supplied IP addresses without proper validation. Use commands like 'composer show symfony/symfony' to verify installed versions. Review application logs for SSRF attempts targeting internal addresses.

Impact Analysis

If you use an affected Symfony version, this vulnerability could allow attackers to perform SSRF attacks against your application. This means they might access internal services, bypass firewalls, or interact with internal network resources. Applications relying on the Ip constraint to validate user-supplied IP addresses before making server-side requests are particularly at risk.

Mitigation Strategies

Immediately update Symfony to patched versions (5.4.56+, 6.4.50+, 7.4.23+, 8.1.11+). If updating is not possible, implement custom validation to reject non-public IP ranges including 100.64.0.0/10, IPv4-mapped IPv6 addresses, and special-purpose IPv6 ranges. Review application logic to ensure user-supplied IPs are validated before SSRF-prone operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123125. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...