Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-48761

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

symfony symfony

  • >= 6.1.0, < 6.4.41affected
  • >= 7.0.0-BETA1, < 7.4.13affected
  • >= 8.0.0-BETA1, < 8.0.13affected

symfony html-sanitizer

  • >= 6.1.0, < 6.4.41affected
  • >= 7.0.0-BETA1, < 7.4.13affected
  • >= 8.0.0-BETA1, < 8.0.13affected

References