CVE-2026-45066
- Source
- https://cve.org/CVERecord?id=CVE-2026-45066
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45066.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-45066
- Aliases
- Downstream
- Published
- 2026-07-14T17:53:49Z
- Modified
- 2026-08-12T03:51:23Z
- Severity
-
- 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
- Details
-
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts() or allowMediaHosts() because UrlSanitizer::parse() follows RFC 3986 while browsers follow WHATWG URL parsing, and because is checked against the media policy rather than the link policy. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-184", "CWE-436" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45066.json" }- References
-
- https://github.com/symfony/symfony/releases/tag/v6.4.40
- https://github.com/symfony/symfony/releases/tag/v7.4.12
- https://github.com/symfony/symfony/releases/tag/v8.0.12
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45066.json
- https://github.com/symfony/symfony/security/advisories/GHSA-qc95-4862-92fh
- https://nvd.nist.gov/vuln/detail/CVE-2026-45066
- https://github.com/symfony/symfony/commit/d506b556d3d3906f3e8660ad82257ce87edbaac4
Affected packages
Git / github.com/symfony/security-http
Affected ranges
- Type
- GIT
- Repo
- https://github.com/symfony/security-http
- Events
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "6.1.0" }, { "fixed": "6.4.40" }, { "introduced": "7.0.0" }, { "fixed": "7.4.12" }, { "introduced": "8.0.0" }, { "fixed": "8.0.12" } ], "source": "CPE_RANGE" }
- Type
- GIT
- Repo
- https://github.com/symfony/symfony
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "6.1.0" }, { "fixed": "6.4.40" }, { "introduced": "7.0.0" }, { "fixed": "7.4.12" }, { "introduced": "8.0.0" }, { "fixed": "8.0.12" } ], "source": [ "CPE_RANGE", "REFERENCES" ] }
Affected versions
v6.*
v6.1.0
v6.1.0-RC1
v6.2.0
v6.2.0-BETA1
v6.2.0-BETA3
v6.2.0-RC1
v6.3.0-BETA1
v6.3.0-RC1
v6.4.0
v6.4.0-BETA1
v6.4.0-BETA3
v6.4.0-RC1
v6.4.0-RC2
v6.4.11
v6.4.12
v6.4.13
v6.4.14
v6.4.15
v6.4.18
v6.4.19
v6.4.21
v6.4.22
v6.4.23
v6.4.24
v6.4.25
v6.4.26
v6.4.3
v6.4.30
v6.4.31
v6.4.34
v6.4.39
v6.4.4
v6.4.7
v6.4.8
v6.4.9
v7.*
v7.0.0
v7.0.0-RC2
v7.0.1
v7.1.0
v7.1.0-BETA1
v7.1.0-RC1
v7.2.0
v7.2.0-BETA1
v7.2.0-BETA2
v7.2.0-RC1
v7.2.1
v7.3.0
v7.3.0-BETA1
v7.3.0-BETA2
v7.3.0-RC1
v7.4.0
v7.4.0-BETA1
v7.4.0-RC1
v7.4.0-RC2
v7.4.1
v7.4.11
v7.4.3
v7.4.4
v7.4.6
v7.4.8
v7.4.9
v8.*
v8.0.0
v8.0.1
v8.0.10
v8.0.11
v8.0.2
v8.0.3
v8.0.4
v8.0.5
v8.0.6
v8.0.7
v8.0.8
v8.0.9