Medium severity5.3OSV Advisory· Published Jul 14, 2026· Updated Jul 15, 2026
CVE-2026-47212
CVE-2026-47212
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doParse() received the configured webhook secret but ignored the X-Twilio-Signature HMAC header, allowing unauthenticated POST requests to inject forged Twilio status payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
symfony/symfonyPackagist | >= 6.4.0, < 6.4.40 | 6.4.40 |
symfony/symfonyPackagist | >= 7.0.0, < 7.4.12 | 7.4.12 |
symfony/symfonyPackagist | >= 8.0.0, < 8.0.12 | 8.0.12 |
symfony/twilio-notifierPackagist | >= 6.4.0, < 6.4.40 | 6.4.40 |
symfony/twilio-notifierPackagist | >= 7.0.0, < 7.4.12 | 7.4.12 |
symfony/twilio-notifierPackagist | >= 8.0.0, < 8.0.12 | 8.0.12 |
Affected products
1- Range: v8.0.11, v7.4.11, v6.4.39, …
Patches
Vulnerability mechanics
References
9- github.com/symfony/symfony/commit/8545fb2af6c07dfb5ef0fc8d9bccf86db2c94356nvdPatchWEB
- github.com/symfony/symfony/security/advisories/GHSA-55rj-x2vc-4whqnvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-55rj-x2vc-4whqghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-47212.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/twilio-notifier/CVE-2026-47212.yamlghsaWEB
- github.com/symfony/symfony/releases/tag/v6.4.40nvdProductRelease Notes
- github.com/symfony/symfony/releases/tag/v7.4.12nvdProductRelease Notes
- github.com/symfony/symfony/releases/tag/v8.0.12nvdProductRelease Notes
- symfony.com/cve-2026-47212ghsaWEB
News mentions
0No linked articles in our index yet.