CVE-2026-45066

Analyzed Analyzed - Analysis Complete

HTML Sanitizer URL Bypass in Symfony Framework

Publication date: 2026-07-14

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts() or allowMediaHosts() because UrlSanitizer::parse() follows RFC 3986 while browsers follow WHATWG URL parsing, and because <area href> is checked against the media policy rather than the link policy. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-45066

EUVD

EUVD-2026-44339

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 7.0.0 (inc) to 7.4.12 (exc)
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.12 (exc)
sensiolabs	symfony	From 6.1.0 (inc) to 6.4.40 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
CWE-436	Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

Executive Summary

This vulnerability in Symfony's HtmlSanitizer component allows malicious URLs to bypass host restrictions set by allowLinkHosts() or allowMediaHosts(). It occurs due to differences between server-side URL parsing (RFC 3986) and browser parsing (WHATWG standard). Attackers can exploit this by using malformed URLs like https://evil\@trusted.com/ or https:/evil.com/ to trick the server into allowing unsafe links that browsers interpret differently.

Detection Guidance

To detect this vulnerability, check if your Symfony application uses versions between 6.1.0-BETA1 and 6.4.39, 7.0 to 7.4.11, or 8.0 to 8.0.11. Inspect HTML sanitizer configurations for allowLinkHosts() or allowMediaHosts() usage. Test URLs with backslashes or malformed schemes (e.g., https:/evil.com/) to see if they bypass restrictions.

Impact Analysis

If exploited, this vulnerability could allow attackers to inject malicious links into your application that appear to come from trusted domains but actually lead to harmful sites. This could result in phishing attacks, malware distribution, or unauthorized data access if users click these links.

Compliance Impact

This vulnerability could lead to violations of data protection regulations like GDPR or HIPAA by enabling phishing attacks that compromise user data. Sanitizing user input is critical for compliance, and failing to do so may result in unauthorized data exposure or breaches.

Mitigation Strategies

Upgrade Symfony to versions 6.4.40, 7.4.12, or 8.0.12 or later. Review and update HTML sanitizer policies to ensure proper enforcement of allowLinkHosts() and allowMediaHosts(). Remove any backslashes or malformed schemes from user-provided URLs before processing.

Hi! I’m here to help you understand CVE-2026-45066. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70