symfony/symfony vulnerabilities

CVEs whose affected-version data names the symfony/symfony package (composer). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

7 CVEsRSS

CVE-2026-48761Medium

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes

▾ Sunlitsymfony · symfony/html-sanitizerEPSS 0.34%via GHSA

CVE-2026-48489High

Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes

Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes

▾ Twilightsymfony · symfony/security-httpEPSS 0.60%via GHSA

CVE-2026-48736Medium

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

▾ Sunlitsymfony · symfony/http-clientEPSS 0.57%via GHSA

CVE-2026-48747Medium

Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade

Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade

▾ Sunlitsymfony · symfony/mailomat-mailerEPSS 0.25%via GHSA

CVE-2026-48760Medium

Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

▾ Sunlitsymfony · symfony/html-sanitizerEPSS 0.34%via GHSA

CVE-2026-48784Medium

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

▾ Sunlitsymfony · symfony/routingEPSS 0.35%via GHSA

CVE-2026-47767Medium

SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

▾ Sunlitsymfony · symfony/runtimeEPSS 0.72%via GHSA

symfony/symfony vulnerabilities (CVEs) · VulnSea