CVE-2026-48784

EUVD-2026-44371

14.07.2026, 20:17

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters to generate URLs that collapse to a different path under RFC 3986 normalization. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.1 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 27.44%

Affected Products (NVD)

Vendor	Product	Version
sensiolabs	symfony	𝑥 < 5.4.53
sensiolabs	symfony	6.0.0 ≤ 𝑥 < 6.4.41
sensiolabs	symfony	7.0.0 ≤ 𝑥 < 7.4.13
sensiolabs	symfony	8.0.0 ≤ 𝑥 < 8.0.13

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

symfony

bookworm	5.4.53+dfsg-0+deb12u1 fixed
bookworm (security)	5.4.53+dfsg-0+deb12u1 fixed
bullseye	vulnerable
bullseye (security)	vulnerable
forky	7.4.16+dfsg-1 fixed
sid	7.4.16+dfsg-1 fixed
trixie	6.4.41+dfsg-0+deb13u1 fixed
trixie (security)	6.4.41+dfsg-0+deb13u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

symfony

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
questing	ignored
resolute	needs-triage
xenial	needs-triage

Common Weakness Enumeration

CWE-172 - Encoding Error
The software does not properly encode or decode the data, resulting in unexpected values.

References

https://github.com/symfony/symfony/commit/4b63c3a3f7af04ecd79c89a594b0b02a01990b1d

https://github.com/symfony/symfony/releases/tag/v5.4.53

https://github.com/symfony/symfony/releases/tag/v6.4.41

https://github.com/symfony/symfony/releases/tag/v7.4.13

https://github.com/symfony/symfony/security/advisories/GHSA-h5x3-xfc9-m39h