CVE-2026-48760

Analyzed Analyzed - Analysis Complete

URL Spoofing in Symfony Framework via BiDi Characters

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse() rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs to retain visual-spoofing characters that downstream consumers could decode or display. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-48760

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 7.0.0 (inc) to 7.4.13 (exc)
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.13 (exc)
sensiolabs	symfony	From 6.1.0 (inc) to 6.4.41 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1007	The product displays information or identifiers to a user, but the display mechanism does not make it easy for the user to distinguish between visually similar or identical glyphs (homoglyphs), which may cause the user to misinterpret a glyph and perform an unintended, insecure action.
CWE-451	The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability in Symfony affects URL sanitization. The UrlSanitizer::parse() function failed to block percent-encoded BiDi (Bidirectional) formatting characters and Unicode whitespace, allowing malicious URLs to bypass visual-spoofing defenses. This could trick users into visiting spoofed websites that appear legitimate.

Detection Guidance

This vulnerability involves Symfony's UrlSanitizer component not properly rejecting percent-encoded BiDi formatting characters or Unicode whitespace. Detection requires checking Symfony versions and inspecting URL parsing logic for improper sanitization. No direct network commands exist, but you can verify Symfony versions using composer show symfony/symfony or check application logs for suspicious URL patterns involving encoded BiDi characters or Unicode whitespace.

Impact Analysis

This vulnerability could allow attackers to create URLs that look like trusted domains but actually lead to malicious sites. Users might be tricked into clicking these links, leading to phishing attacks, credential theft, or malware downloads. Websites using affected Symfony versions are at risk.

Compliance Impact

This vulnerability allows visual-spoofing characters in sanitized URLs to bypass security checks, potentially enabling phishing attacks or misleading users. While not directly violating GDPR or HIPAA, such attacks could compromise user trust, data integrity, or confidentiality, indirectly impacting compliance by exposing systems to unauthorized access or deception.

Mitigation Strategies

Immediately upgrade Symfony to versions 6.4.41, 7.4.13, or 8.0.13 or later. If upgrading is not possible, review and modify URL sanitization logic to explicitly reject percent-encoded BiDi marks and Unicode whitespace characters before processing. Implement additional input validation for URLs in your application.

Hi! I’m here to help you understand CVE-2026-48760. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70