PHP security advisories

Symfony HtmlSanitizer: Hostless URLs Slip Past Link and Media Host Lists

Lets links or media point to hosts outside allowLinkHosts() or allowMediaHosts() when allowRelativeLinks or allowRelativeMedias is on.

Fixed in 8.1.11, 7.4.23 and 6.4.50

Symfony Security: HEAD Requests Skip access_control Rules Limited to GET

Lets HEAD requests reach pages that access_control rules or firewalls protect only for GET, running the controller without the check.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony Routing: Host Placeholders Can Bypass Path-Based Access Rules

Lets requests reach controllers that path-based access_control rules protect, in apps with routes that use host placeholders.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony X509 Login: Crafted Certificate Names Can Log In as Another User

Lets a client certificate holder log in as another user's email address in apps that use Symfony's X509 authenticator.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony Serializer: Fake UploadedFile Data Can Point at Any Server File

Lets a client make an app treat any server file as an upload in apps that deserialize request data into UploadedFile properties.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony Serializer: Nested Properties Marked #[Ignore] Can Still Be Set

Lets a client set #[Ignore] properties on nested objects in apps that deserialize input with ObjectNormalizer, such as #[MapRequestPayload].

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56 · 1 older release

Symfony JsonPath: Crafted Queries Can Still Tie Up a Worker

Lets an attacker keep a PHP worker busy for minutes in apps that run JSONPath queries an attacker can influence, despite the CVE-2026-45756 fix.

Fixed in 8.1.11 and 7.4.23

Symfony HttpClient: DNS Rebinding Lets NoPrivateNetworkHttpClient Probe Ports

Lets an attacker who controls a host's DNS probe internal hosts and ports through repeated NoPrivateNetworkHttpClient requests to that host.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony Filesystem: Crafted Paths Can Escape Their Base Directory

Lets an attacker read or write files outside an allowed folder in apps that check user paths with Path, and lets packages write outside assets/vendor.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony HttpKernel: Inline Fragments Let Forwarded Headers Change URLs

Lets client headers set the host of absolute URLs after an inline fragment renders, in apps reached from 127.0.0.1 without it as a trusted proxy.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56 · 2 older releases

Symfony HtmlSanitizer: Meta Refresh URLs Slip Past Link Checks

Lets meta refresh tags send visitors to blocked hosts or javascript: URLs in apps that allow meta refresh through HtmlSanitizer.

Fixed in 8.1.11, 7.4.23 and 6.4.50

Symfony Config: XmlUtils::parse() Resolves External Entities in Untrusted XML

Can reveal whether server files exist, or leak them through network stream wrappers, in apps that pass untrusted XML to XmlUtils::parse().

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony HttpClient: Scoped Client Can Send Credentials to Other Hosts

Can send a scoped client's token or other credentials to another host when an attacker controls the start of a URL the app requests.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony HtmlSanitizer: srcset Images Skip Media Scheme and Host Checks

Lets sanitized HTML load images from hosts outside allowMediaHosts() through srcset or imagesrcset attributes.

Fixed in 8.1.11, 7.4.23 and 6.4.50

Symfony Security: Programmatic Logins Skip checkPostAuth() User Checks

Lets accounts a user checker rejects in checkPostAuth(), such as expired ones, log in through Security::login() or authenticateUser().

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony Serializer: Data URIs Can Read Any File on the Server

Lets a client read any file PHP can read in apps that deserialize client data into SplFileObject, SplFileInfo or File properties.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony Yaml: Small Documents Can Tie Up the Parser for Minutes

Lets an attacker keep a PHP worker busy with one small YAML document in apps that parse untrusted YAML, including some #[MapRequestPayload] endpoints.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony HttpFoundation: Crafted Links Make Generated URLs Point Elsewhere

Lets a crafted link make an app's links, forms and redirects point to another host, when its front controller sits in a subdirectory.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony: private_ranges Trusted Proxies Setting Trusts Some Remote Clients

Lets some IPv6 clients pass as trusted proxies and set X-Forwarded headers in apps that use trusted_proxies: private_ranges.

Fixed in 8.1.11 and 7.4.23

Symfony HttpFoundation: Paths Glued to index.php Bypass Web Server Path Rules

Lets requests get past nginx, Apache, CDN or WAF rules on a path like /admin, while Symfony still routes them to that path.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony Validator: Ip Constraint Accepts Some Internal Addresses as Public

Lets internal addresses pass #[Assert\Ip] public or no-private checks, getting past SSRF guards built on the Ip constraint.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Doctrine MongoDB ODM: Encrypted Fields Can Be Stored as Plain Text

Can store fields marked #[Encrypt] unencrypted in MongoDB collections that mix a class's own encrypted fields with encrypted embedded documents.

Fixed in 2.17.3

Symfony Mime: Header Injection Through Mime Parameter Names

Lets an attacker add extra email headers in apps that build a Content-Type or Content-Disposition parameter name from user input.

Fixed in 8.1.10, 7.4.22, 6.4.49 and 5.4.55

Laravel TokenGuard: Log In as Any User Without Their API Token

Lets an unauthenticated attacker log in as another user in Laravel apps that use the token auth guard with MySQL or MariaDB.

Fixed in 13.29.0 and 12.68.0

Laravel: Relationship Includes on Read Endpoints Can Destroy Data

Lets a user with only read access trigger a destructive query, such as emptying a related table, through relationship includes in some Laravel apps.

Fixed in 13.27.0 and 12.68.0

Symfony ExpressionLanguage: Deeply Nested Expressions Crash PHP

Lets an attacker crash the PHP process with one request in apps that parse or validate expressions written by users.

Fixed in 8.1.9, 7.4.21, 6.4.48 and 5.4.54

Composer: Malicious Package Can Change File Permissions Outside Vendor

Lets a malicious dependency make a file outside its own folder readable and runnable by anyone, getting around the earlier GHSA-gjfg-22fp-rrxx fix.

Fixed in 2.10.3 · 1 older release

Laravel Debug Page: Cross-Site Scripting When APP_DEBUG Is On

Lets an attacker run script in a visitor's browser through the Laravel debug error page, when APP_DEBUG=true and the visitor hovers a tooltip.

Fixed in 13.30.0 and 12.69.0

Symfony HttpFoundation: Crafted Cache-Control Header Ties Up the CPU

Lets an unauthenticated attacker burn close to a second of CPU per request with a crafted Cache-Control header, in any app built on HttpFoundation.

Fixed in 8.1.7, 7.4.19, 6.4.46 and 5.4.54

Composer: Malicious Package Can Run Commands via a Perforce Source URL

Lets a malicious package run commands during composer install on machines with the p4 client, when it comes from a repository other than Packagist.org.

Fixed in 2.10.3 · 1 older release

Symfony Yaml: Deeply Nested Inline YAML Crashes the Process

Lets an attacker crash the PHP process with one YAML document in apps that parse untrusted YAML, including some #[MapRequestPayload] endpoints.

Fixed in 8.1.6, 7.4.18, 6.4.45 and 5.4.54

Guzzle: Oddly Written Hosts Can Slip Past Host-Based Checks

Lets an attacker reach hosts an app meant to block, such as loopback, when the app builds Guzzle request URLs from user input and checks the host first.

Fixed in 8.0.1 and 7.15.2

Guzzle: Cookies for Numeric or Escaped Domains Leak to Other Hosts

Can leak cookies set for an IP-style Domain to other hosts in apps that use Guzzle's cookie jar, exposing session ids or tokens.

Fixed in 8.0.1 and 7.15.2

guzzlehttp/psr7: Malformed URI Hosts Can Fool Host Checks

Lets an attacker get past host allowlists or SSRF checks in apps that build a psr7 Uri from user input and trust getHost().

Fixed in 2.12.3

Guzzle: Redirects Can Leak URL Fragments in the Referer Header

Can leak secrets kept in a URL fragment to a redirect target, in apps that turn on Guzzle's referer redirect option.

Fixed in 7.15.1

Guzzle: Host-Only Cookies Are Sent to Subdomains

Can send a parent host's session cookies to its subdomains in apps that reuse one Guzzle cookie jar across hosts.

Fixed in 7.15.1