Medium severity6.1NVD Advisory· Published Jul 14, 2026· Updated Jul 16, 2026
CVE-2026-45066
CVE-2026-45066
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts() or allowMediaHosts() because UrlSanitizer::parse() follows RFC 3986 while browsers follow WHATWG URL parsing, and because is checked against the media policy rather than the link policy. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
symfony/html-sanitizerPackagist | >= 6.1.0, < 6.4.40 | 6.4.40 |
symfony/html-sanitizerPackagist | >= 7.0.0, < 7.4.12 | 7.4.12 |
symfony/html-sanitizerPackagist | >= 8.0.0, < 8.0.12 | 8.0.12 |
symfony/symfonyPackagist | >= 6.1.0, < 6.4.40 | 6.4.40 |
symfony/symfonyPackagist | >= 7.0.0, < 7.4.12 | 7.4.12 |
symfony/symfonyPackagist | >= 8.0.0, < 8.0.12 | 8.0.12 |
Affected products
2- ghsa-coords2 versions
>= 6.1.0, < 6.4.40+ 1 more
- (no CPE)range: >= 6.1.0, < 6.4.40
- (no CPE)range: >= 6.1.0, < 6.4.40
Patches
Vulnerability mechanics
References
9- github.com/symfony/symfony/commit/d506b556d3d3906f3e8660ad82257ce87edbaac4nvdPatch
- github.com/symfony/symfony/security/advisories/GHSA-qc95-4862-92fhnvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-qc95-4862-92fhghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/html-sanitizer/CVE-2026-45066.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45066.yamlghsaWEB
- github.com/symfony/symfony/releases/tag/v6.4.40nvdProductRelease Notes
- github.com/symfony/symfony/releases/tag/v7.4.12nvdProductRelease Notes
- github.com/symfony/symfony/releases/tag/v8.0.12nvdProductRelease Notes
- symfony.com/cve-2026-45066ghsaWEB
News mentions
0No linked articles in our index yet.