GHSA-qc95-4862-92fh
Suggest an improvement- Source
- https://github.com/advisories/GHSA-qc95-4862-92fh
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-qc95-4862-92fh/GHSA-qc95-4862-92fh.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-qc95-4862-92fh
- Aliases
-
- CVE-2026-45066
- Published
- 2026-05-27T20:13:04Z
- Modified
- 2026-05-27T20:30:09.066989677Z
- Summary
- Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
- Details
-
Description
symfony/html-sanitizerlets applications sanitise untrusted HTML. The configuration methodsallowLinkHosts([...])andallowLinkSchemes([...])are intended to restrict<a href>targets to an allowlist of hosts/schemes;allowMediaHosts()/allowMediaSchemes()do the same for<img src>etc.Three distinct bypasses allow a content author to smuggle off-allowlist URLs past these checks. First,
UrlSanitizer::parse()parses the input following RFC-3986, while browsers follow the WHATWG URL Standard which normalises\to/before parsing the authority of "special" schemes; so an input likehttps://evil\@trusted.com/parses with hosttrusted.comserver-side but navigates tohttps://evil/in the browser. Second, WHATWG collapses any run of/after the scheme into//, while RFC-3986 does not; sohttps:/evil.com/andhttps:///evil.com/parse as host-less (skipping the host allowlist) but resolve toevil.comin the browser. Third,UrlAttributeSanitizerchecks'a' === $elementto route to the link policy and falls through to the media policy otherwise, but<area>is a navigable hyperlink equivalent to<a>; so<area href>was sanitised against the media policy (which typically allowsdata:and may have no host allowlist), bypassingallowLinkHosts()/allowLinkSchemes()entirely.Resolution
UrlSanitizer::sanitize()now rejects URLs that contain a backslash or that use a special scheme (http,https,ftp,ws,wss) followed by a single slash or three slashes before parsing, eliminating the parser-differential bypasses.UrlAttributeSanitizernow applies the link policy to both<a>and<area>elements.The patch for this issue is available here for branch 5.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Database specific
{ "cwe_ids": [ "CWE-184", "CWE-436" ], "github_reviewed": true, "nvd_published_at": null, "github_reviewed_at": "2026-05-27T20:13:04Z", "severity": "MODERATE" }- References
-
- https://github.com/symfony/symfony/security/advisories/GHSA-qc95-4862-92fh
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/html-sanitizer/CVE-2026-45066.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45066.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45066
Affected packages
Packagist
symfony/html-sanitizer
Package
- Name
- symfony/html-sanitizer
- Purl
- pkg:composer/symfony%2Fhtml-sanitizer
symfony/html-sanitizer
Package
- Name
- symfony/html-sanitizer
- Purl
- pkg:composer/symfony%2Fhtml-sanitizer
symfony/html-sanitizer
Package
- Name
- symfony/html-sanitizer
- Purl
- pkg:composer/symfony%2Fhtml-sanitizer
symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony%2Fsymfony
Affected versions
v6.*
symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony%2Fsymfony