CVE-2026-45064

Analyzed Analyzed - Analysis Complete

BiDi Character Spoofing in Symfony Framework

Publication date: 2026-07-14

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse() passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized content to display a link destination that visually differs from the actual destination and enabling phishing-style visual spoofing. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-21

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-45064

EUVD

EUVD-2026-44348

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 7.0.0 (inc) to 7.4.12 (exc)
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.12 (exc)
sensiolabs	symfony	From 6.1.0 (inc) to 6.4.40 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1007	The product displays information or identifiers to a user, but the display mechanism does not make it easy for the user to distinguish between visually similar or identical glyphs (homoglyphs), which may cause the user to misinterpret a glyph and perform an unintended, insecure action.
CWE-451	The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability in Symfony's UrlSanitizer::parse() function allows Unicode BiDi formatting characters to pass through into sanitized href and src attributes. This can visually spoof URLs, making malicious links appear legitimate while redirecting to harmful destinations.

Detection Guidance

To detect this vulnerability, check if your Symfony application uses versions 6.1.0-BETA1 to 6.4.39, 7.0 to 7.4.11, or 8.0 to 8.0.11. Inspect sanitized URLs in href or src attributes for Unicode BiDi characters (U+202A to U+202E, U+2066 to U+2069). Use commands like grep to search for these characters in HTML output or logs.

Impact Analysis

Attackers can trick users into clicking malicious links that appear legitimate due to visual spoofing. This could lead to phishing attacks, credential theft, or malware downloads. Users might unknowingly visit harmful websites believing they are safe.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using affected Symfony versions may fail compliance audits due to insufficient URL validation.

Mitigation Strategies

Upgrade Symfony to versions 6.4.40, 7.4.12, or 8.0.12 or later. If upgrading is not possible, apply the patch from the Symfony commit 743a435 to reject BiDi characters and percent-encode spaces in URLs. Review and sanitize all user-provided URLs in your application.

Hi! I’m here to help you understand CVE-2026-45064. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70