{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118517", "assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "state": "PUBLISHED", "assignerShortName": "Checkmarx", "dateReserved": "2026-10-28T14:33:36.992Z", "datePublished": "2026-11-05T16:26:52.166Z", "dateUpdated": "2026-11-05T16:52:28.063Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "shortName": "Checkmarx", "dateUpdated": "2026-11-05T16:26:52.166Z"}, "title": "Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-184", "description": "CWE-184 Incomplete List of Disallowed Inputs", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-436", "description": "CWE-436 Interpretation Conflict", "type": "CWE"}]}], "affected": [{"vendor": "sensiolabs", "product": "symfony", "collectionURL": "https://packagist.org/packages/symfony/http-client", "packageName": "symfony/http-client", "repo": "https://github.com/symfony/http-client", "modules": ["Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer"], "versions": [{"status": "affected", "version": "6.1.0", "lessThan": "6.4.50", "versionType": "git"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.4.23", "versionType": "git"}, {"status": "affected", "version": "8.0.0", "lessThan": "8.1.11", "versionType": "git"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.0", "versionEndExcluding": "6.4.50"}, {"vulnerable": true, "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.4.23"}, {"vulnerable": true, "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.1.11"}]}]}], "descriptions": [{"lang": "en", "value": "The Symfony HtmlSanitizer component UrlSanitizer\u00a0parses URLs differently from browsers, allowing\u00a0the allowLinkHosts() and allowMediaHosts() checks to be bypassed for URLs without a well-formed authority,\u00a0resulting in untrusted hosts being referenced in sanitized output\u00a0in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\n\n\nUrlSanitizer parses URLs with league/uri, which follows RFC 3986, while browsers follow the WHATWG URL standard.\u00a0For URLs without a well-formed authority, such as http:evil.example, ///evil.example, or https://://evil.example/\u00a0the sanitizer finds no host, whereas browsers resolve them to evil.example. The guard added for CVE-2026-45066 missed the zero-slash form, and the host 0 was also skipped because PHP treats it as falsy.\n\n\n\nThis is exploitable when a host allow-list is combined with allowRelativeLinks(true) or allowRelativeMedias(true). The default configuration is not affected.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The Symfony HtmlSanitizer component <code>UrlSanitizer</code>&nbsp;parses URLs differently from browsers, allowing&nbsp;<span>the </span><code>allowLinkHosts()</code><span> and </span><code>allowMediaHosts()</code><span> checks to be bypassed for URLs without a well-formed authority,</span><span>&nbsp;</span>resulting in untrusted hosts being referenced in sanitized output<span>&nbsp;in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.</span></p><p><code>UrlSanitizer</code><span> parses URLs with </span><code>league/uri</code><span>, which follows RFC 3986, while browsers follow the WHATWG URL standard.&nbsp;</span>For URLs without a well-formed authority, such as <code>http:evil.example</code>, <code>///evil.example</code>, or <code>https://://evil.example/&nbsp;</code>t<span>he sanitizer finds no host, whereas browsers resolve them to </span><code>evil.example</code><span>. The guard added for CVE-2026-45066 missed the zero-slash form, and the host </span><code>0</code><span> was also skipped because PHP treats it as falsy.</span></p><p><span>This is exploitable when a host allow-list is combined with </span><code>allowRelativeLinks(true)</code><span> or </span><code>allowRelativeMedias(true)</code><span>. The default configuration is not affected.</span></p>"}]}], "references": [{"url": "https://github.com/symfony/symfony/security/advisories/GHSA-c76g-9c4c-gxrw", "tags": ["third-party-advisory"]}, {"url": "https://github.com/symfony/symfony/commit/f2f47d2eef6c2552c6c5c24953caa94f7901cb43", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Nicolas Grekas", "type": "remediation developer"}, {"lang": "en", "value": "Ilia Alshanetsky", "type": "reporter"}], "source": {"advisory": "GHSA-c76g-9c4c-gxrw", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T16:49:56.410466Z", "id": "CVE-2026-118517", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:52:28.063Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org/packages/symfony/http-client", "defaultStatus": "unaffected", "modules": ["Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer"], "packageName": "symfony/http-client", "product": "symfony", "repo": "https://github.com/symfony/http-client", "vendor": "sensiolabs", "versions": [{"lessThan": "6.4.50", "status": "affected", "version": "6.1.0", "versionType": "git"}, {"lessThan": "7.4.23", "status": "affected", "version": "7.0.0", "versionType": "git"}, {"lessThan": "8.1.11", "status": "affected", "version": "8.0.0", "versionType": "git"}]}], "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Symfony HtmlSanitizer component UrlSanitizer\u00a0parses URLs differently from browsers, allowing\u00a0the allowLinkHosts() and allowMediaHosts() checks to be bypassed for URLs without a well-formed authority,\u00a0resulting in untrusted hosts being referenced in sanitized output\u00a0in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\n\n\nUrlSanitizer parses URLs with league/uri, which follows RFC 3986, while browsers follow the WHATWG URL standard.\u00a0For URLs without a well-formed authority, such as http:evil.example, ///evil.example, or https://://evil.example/\u00a0the sanitizer finds no host, whereas browsers resolve them to evil.example. The guard added for CVE-2026-45066 missed the zero-slash form, and the host 0 was also skipped because PHP treats it as falsy.\n\n\n\nThis is exploitable when a host allow-list is combined with allowRelativeLinks(true) or allowRelativeMedias(true). The default configuration is not affected."}], "id": "CVE-2026-118517", "lastModified": "2026-11-05T17:17:53.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118517", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T16:49:56.410466Z", "version": "2.0.3"}}]}, "published": "2026-11-05T17:17:53.147", "references": [{"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "url": "https://github.com/symfony/symfony/commit/f2f47d2eef6c2552c6c5c24953caa94f7901cb43"}, {"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "url": "https://github.com/symfony/symfony/security/advisories/GHSA-c76g-9c4c-gxrw"}], "sourceIdentifier": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-184"}, {"lang": "en", "value": "CWE-436"}], "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "type": "Secondary"}]}

{"bugzilla": {"description": "symfony/html-sanitizer: symfony/html-sanitizer: Host allowlist bypass via URL parsing inconsistency", "id": "2567785", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567785"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-1289", "details": ["A flaw was found in the Symfony HtmlSanitizer component. Due to differences in how URLs are parsed compared to web browsers, the component fails to properly detect hosts in certain malformed URLs when host allowlists are enforced. A remote attacker can exploit this vulnerability by submitting specially crafted URLs to bypass host validation, resulting in untrusted links or media being retained in sanitized output."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, avoid combining host allowlists with relative link or relative media permissions in the HtmlSanitizer configuration. Ensure that `allowRelativeLinks` and `allowRelativeMedias` remain disabled (set to `false`), which is the default configuration.\nCaveat: Disabling relative links or media causes relative paths to be stripped or rejected in sanitized content, which may impact applications relying on relative URLs. Applying configuration changes to the application environment may require restarting the web server or PHP-FPM service."}, "name": "CVE-2026-118517", "public_date": "2026-11-05T16:26:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118517\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118517\nhttps://github.com/symfony/symfony/commit/f2f47d2eef6c2552c6c5c24953caa94f7901cb43\nhttps://github.com/symfony/symfony/security/advisories/GHSA-c76g-9c4c-gxrw"], "statement": "This vulnerability is rated as Moderate impact because successful exploitation requires non-default configuration and user interaction, limiting the blast radius to partial integrity loss without compromising system availability or data confidentiality. Under standard configurations, HtmlSanitizer does not permit relative paths alongside host filtering, leaving default deployments unaffected. Exposure is confined to custom implementations that explicitly enable relative links or media alongside host allowlists, enabling malformed URIs to evade host-matching controls when interpreted by client web browsers.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.0,6.4.50)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.4.23)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.1.11)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "symfony", "source": "cna", "vendor": "sensiolabs"}, "product": "symfony", "vendor": "sensiolabs"}], "created": "2026-11-05T17:45:06.103006+00:00", "updated": "2026-11-06T14:30:06.078679+00:00", "vendors": ["sensiolabs", "sensiolabs$PRODUCT$symfony"]}