Critical: PHP has an open critical advisory
Read the advisory →Symfony stack security advisories
The tools a typical Symfony app runs on, in one list: PHP, Symfony, Doctrine, Guzzle and Composer.
26 advisories affect supported versions.
Tools in the stack
Each has its own page, with its supported branches and a check for your version.
Advisories across the stack
276 advisories, newest first.
-
low CVE-2026-118517 Reviewed
Symfony HtmlSanitizer: Hostless URLs Slip Past Link and Media Host Lists
Lets links or media point to hosts outside allowLinkHosts() or allowMediaHosts() when allowRelativeLinks or allowRelativeMedias is on.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 -
high CVE-2026-118514 Reviewed
Symfony Security: HEAD Requests Skip access_control Rules Limited to GET
Lets HEAD requests reach pages that access_control rules or firewalls protect only for GET, running the controller without the check.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
high CVE-2026-118513 Reviewed
Symfony X509 Login: Crafted Certificate Names Can Log In as Another User
Lets a client certificate holder log in as another user's email address in apps that use Symfony's X509 authenticator.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
high CVE-2026-118515 Reviewed
Symfony Serializer: Fake UploadedFile Data Can Point at Any Server File
Lets a client make an app treat any server file as an upload in apps that deserialize request data into UploadedFile properties.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
high CVE-2026-118516 Reviewed
Symfony Routing: Host Placeholders Can Bypass Path-Based Access Rules
Lets requests reach controllers that path-based access_control rules protect, in apps with routes that use host placeholders.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
medium CVE-2026-123125 Reviewed
Symfony Validator: Ip Constraint Accepts Some Internal Addresses as Public
Lets internal addresses pass #[Assert\Ip] public or no-private checks, getting past SSRF guards built on the Ip constraint.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
low Reviewed
Symfony HttpFoundation: Paths Glued to index.php Bypass Web Server Path Rules
Lets requests get past nginx, Apache, CDN or WAF rules on a path like /admin, while Symfony still routes them to that path.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
medium Reviewed
Symfony: private_ranges Trusted Proxies Setting Trusts Some Remote Clients
Lets some IPv6 clients pass as trusted proxies and set X-Forwarded headers in apps that use trusted_proxies: private_ranges.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 -
medium Reviewed
Symfony HttpFoundation: Crafted Links Make Generated URLs Point Elsewhere
Lets a crafted link make an app's links, forms and redirects point to another host, when its front controller sits in a subdirectory.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
high CVE-2026-123792 Reviewed
Symfony Yaml: Small Documents Can Tie Up the Parser for Minutes
Lets an attacker keep a PHP worker busy with one small YAML document in apps that parse untrusted YAML, including some #[MapRequestPayload] endpoints.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
high CVE-2026-121623 Reviewed
Symfony Serializer: Data URIs Can Read Any File on the Server
Lets a client read any file PHP can read in apps that deserialize client data into SplFileObject, SplFileInfo or File properties.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
medium CVE-2026-122053 Reviewed
Symfony Serializer: Nested Properties Marked #[Ignore] Can Still Be Set
Lets a client set #[Ignore] properties on nested objects in apps that deserialize input with ObjectNormalizer, such as #[MapRequestPayload].
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56+ 1 older release
-
low CVE-2026-123746 Reviewed
Symfony Security: Programmatic Logins Skip checkPostAuth() User Checks
Lets accounts a user checker rejects in checkPostAuth(), such as expired ones, log in through Security::login() or authenticateUser().
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
low CVE-2026-121949 Reviewed
Symfony HtmlSanitizer: srcset Images Skip Media Scheme and Host Checks
Lets sanitized HTML load images from hosts outside allowMediaHosts() through srcset or imagesrcset attributes.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 -
high CVE-2026-121971 Reviewed
Symfony HttpClient: Scoped Client Can Send Credentials to Other Hosts
Can send a scoped client's token or other credentials to another host when an attacker controls the start of a URL the app requests.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
low CVE-2026-123824 Reviewed
Symfony Config: XmlUtils::parse() Resolves External Entities in Untrusted XML
Can reveal whether server files exist, or leak them through network stream wrappers, in apps that pass untrusted XML to XmlUtils::parse().
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
medium CVE-2026-121373 Reviewed
Symfony HtmlSanitizer: Meta Refresh URLs Slip Past Link Checks
Lets meta refresh tags send visitors to blocked hosts or javascript: URLs in apps that allow meta refresh through HtmlSanitizer.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 -
low CVE-2026-123339 Reviewed
Symfony HttpKernel: Inline Fragments Let Forwarded Headers Change URLs
Lets client headers set the host of absolute URLs after an inline fragment renders, in apps reached from 127.0.0.1 without it as a trusted proxy.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56+ 2 older releases
-
high Reviewed
Symfony Filesystem: Crafted Paths Can Escape Their Base Directory
Lets an attacker read or write files outside an allowed folder in apps that check user paths with Path, and lets packages write outside assets/vendor.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
low CVE-2026-123119 Reviewed
Symfony HttpClient: DNS Rebinding Lets NoPrivateNetworkHttpClient Probe Ports
Lets an attacker who controls a host's DNS probe internal hosts and ports through repeated NoPrivateNetworkHttpClient requests to that host.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
medium Reviewed
Symfony JsonPath: Crafted Queries Can Still Tie Up a Worker
Lets an attacker keep a PHP worker busy for minutes in apps that run JSONPath queries an attacker can influence, despite the CVE-2026-45756 fix.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 -
medium Reviewed
Doctrine MongoDB ODM: Encrypted Fields Can Be Stored as Plain Text
Can store fields marked #[Encrypt] unencrypted in MongoDB collections that mix a class's own encrypted fields with encrypted embedded documents.
Update Doctrine to
2.17.x 2.17.3 -
medium CVE-2026-45070 Reviewed
Symfony Mime: Header Injection Through Mime Parameter Names
Lets an attacker add extra email headers in apps that build a Content-Type or Content-Disposition parameter name from user input.
Update Symfony to
8.1.x 8.1.10 7.4.x 7.4.22 6.4.x 6.4.49 5.4.x 5.4.55 -
critical CVE-2026-109618
RCE via OOM corruption
Update PHP to
8.5.x 8.5.12 8.4.x 8.4.27 8.3.x 8.3.36 8.2.x 8.2.35 -
critical CVE-2026-109619
RCE via stale global state
Update PHP to
8.5.x 8.5.12 8.4.x 8.4.27 8.3.x 8.3.36 8.2.x 8.2.35 -
medium CVE-2026-109449 Reviewed
Symfony ExpressionLanguage: Deeply Nested Expressions Crash PHP
Lets an attacker crash the PHP process with one request in apps that parse or validate expressions written by users.
Update Symfony to
8.1.x 8.1.9 7.4.x 7.4.21 6.4.x 6.4.48 5.4.x 5.4.54 -
medium CVE-2026-59944 Reviewed
Composer: Malicious Package Can Change File Permissions Outside Vendor
Lets a malicious dependency make a file outside its own folder readable and runnable by anyone, getting around the earlier GHSA-gjfg-22fp-rrxx fix.
Update Composer to
2.10.x 2.10.3+ 1 older release
-
medium CVE-2026-93682
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-92842
OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
Update PHP to
8.5.x 8.5.10 8.4.x 8.4.25 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91768
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91769
TLS Hostname Verification Falls Back to CN After SAN Mismatch
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91767
Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
low CVE-2025-1218
Various packet overreads in mysqlnd_writeprotocol.c
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91766
Cross-origin credential leak in HTTP stream wrapper redirects
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
high CVE-2026-91765
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2025-14181
Integer overflow to buffer overflow in soap HTTP parsing
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-6103
Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-17545
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
high CVE-2026-108082 Reviewed
Symfony HttpFoundation: Crafted Cache-Control Header Ties Up the CPU
Lets an unauthenticated attacker burn close to a second of CPU per request with a crafted Cache-Control header, in any app built on HttpFoundation.
Update Symfony to
8.1.x 8.1.7 7.4.x 7.4.19 6.4.x 6.4.46 5.4.x 5.4.54 -
high CVE-2026-84361 Reviewed
Composer: Malicious Package Can Run Commands via a Perforce Source URL
Lets a malicious package run commands during composer install on machines with the p4 client, when it comes from a repository other than Packagist.org.
Update Composer to
2.10.x 2.10.3+ 1 older release
-
high CVE-2026-109413 Reviewed
Symfony Yaml: Deeply Nested Inline YAML Crashes the Process
Lets an attacker crash the PHP process with one YAML document in apps that parse untrusted YAML, including some #[MapRequestPayload] endpoints.
Update Symfony to
8.1.x 8.1.6 7.4.x 7.4.18 6.4.x 6.4.45 5.4.x 5.4.54 -
high CVE-2026-69246 Reviewed
Guzzle: Oddly Written Hosts Can Slip Past Host-Based Checks
Lets an attacker reach hosts an app meant to block, such as loopback, when the app builds Guzzle request URLs from user input and checks the host first.
Update Guzzle to
8.0.x 8.0.1 7.15.x 7.15.2 -
medium CVE-2026-69245 Reviewed
Guzzle: Cookies for Numeric or Escaped Domains Leak to Other Hosts
Can leak cookies set for an IP-style Domain to other hosts in apps that use Guzzle's cookie jar, exposing session ids or tokens.
Update Guzzle to
8.0.x 8.0.1 7.15.x 7.15.2 -
medium CVE-2026-7260
Stack overflow in phar with circular symlinks
Update PHP to
8.5.x 8.5.9 8.4.x 8.4.24 8.3.x 8.3.33 8.2.x 8.2.33 -
high CVE-2026-17544
Out-of-bounds write in bccomp() via crafted operand and scale
Update PHP to
8.5.x 8.5.9 8.4.x 8.4.24 -
high CVE-2026-17543
SQL injection in ext-pgsql via E'...' backslash breakout
Update PHP to
8.5.x 8.5.9 8.4.x 8.4.24 8.3.x 8.3.33 8.2.x 8.2.33 -
medium CVE-2026-59882 Reviewed
guzzlehttp/psr7: Malformed URI Hosts Can Fool Host Checks
Lets an attacker get past host allowlists or SSRF checks in apps that build a psr7 Uri from user input and trust getHost().
Update Guzzle to
2.12.x 2.12.3 -
medium CVE-2026-67354 Reviewed
Guzzle: Redirects Can Leak URL Fragments in the Referer Header
Can leak secrets kept in a URL fragment to a redirect target, in apps that turn on Guzzle's referer redirect option.
Update Guzzle to
7.15.x 7.15.1 -
medium CVE-2026-67355 Reviewed
Guzzle: Host-Only Cookies Are Sent to Subdomains
Can send a parent host's session cookies to its subdomains in apps that reuse one Guzzle cookie jar across hosts.
Update Guzzle to
7.15.x 7.15.1 -
medium CVE-2026-67353 Reviewed
Guzzle: Malicious Server Can Flood the Cookie Jar
Lets a malicious server fill Guzzle's cookie jar with large cookies, using memory and breaking later requests that share the jar.
Update Guzzle to
7.15.x 7.15.1 -
medium CVE-2026-59883 Reviewed
Guzzle: Cookies Set for IP Addresses Leak to Look-Alike Hosts
Can send cookies scoped to an IP address to other hosts, or let those hosts plant cookies, in apps that use Guzzle's cookie jar.
Update Guzzle to
7.12.x 7.12.3 -
medium CVE-2026-59946 Reviewed
Composer: Malicious Package Can Make Private Files World-Readable
Lets a malicious dependency change permissions on files outside its folder, making private files such as SSH keys readable by other users.
Update Composer to
2.10.x 2.10.2+ 1 older release
-
medium CVE-2026-59947 Reviewed
Composer: Tokens in Repository URLs Leak Into -vvv Debug Logs
Exposes access tokens placed in the username part of a repository URL to anyone who can read Composer's -vvv debug output.
Update Composer to
2.10.x 2.10.2+ 1 older release
-
medium CVE-2026-67339 Reviewed
Guzzle: Proxy Credentials Can Be Sent to the Destination Server
Can send Proxy-Authorization credentials to the target server when a request skips the HTTP proxy, with Guzzle's cURL handlers.
Update Guzzle to
7.14.x 7.14.2 -
high CVE-2026-59948 Reviewed
Composer: Malicious Package Name Can Write Files Outside Vendor
Lets a malicious package from a third-party repository write files anywhere the Composer user can, which can lead to running code.
Update Composer to
2.10.x 2.10.2+ 1 older release
-
high CVE-2026-12184
Failure to setup TLS with a remote server can result in a remote DoS
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.32 -
medium CVE-2026-14355
ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
Update PHP to
8.5.x 8.5.8 8.4.x 8.4.23 8.3.x 8.3.32 8.2.x 8.2.32 -
high CVE-2026-49981 Reviewed
Twig Sandbox: Allow-List Bypass When Sandbox State Changes
Lets an untrusted template use forbidden filters, tags and functions when one Twig environment renders both sandboxed and normal templates.
No fixed release listed yet
-
high CVE-2026-55878 Reviewed
Symfony UX Toolkit: Malicious Kit Can Read and Write Any File
Lets a crafted or compromised recipe kit read or overwrite files outside the project when you run ux:install, which can lead to running code.
Update Symfony UX to
3.2.x 3.2.0 2.36.x 2.36.1 -
medium CVE-2026-55877 Reviewed
Symfony UX Icons: Malicious SVG Icons Can Run Scripts in the Page
Lets a malicious icon file or Iconify endpoint run script in visitors' browsers in apps that render icons with ux_icon().
Update Symfony UX to
3.2.x 3.2.0 2.36.x 2.36.1 -
medium CVE-2026-55767 Reviewed
Guzzle: Cookies With a Dot-Only Domain Are Sent to Every Host
Lets a malicious server plant a cookie that Guzzle then sends to every other host using the same cookie jar.
Update Guzzle to
7.12.x 7.12.1 -
medium CVE-2026-55568 Reviewed
Guzzle: HTTPS Proxy Silently Falls Back to Cleartext on Old libcurl
Can send proxy traffic unencrypted when Guzzle is set to use an https:// proxy and the server's libcurl is older than 7.50.2.
Update Guzzle to
7.12.x 7.12.1 -
medium CVE-2026-55766 Reviewed
guzzlehttp/psr7: Header Injection Through the Method or Reason Phrase
Lets an attacker inject HTTP headers when an app puts user input in a psr7 method, protocol or reason phrase and serializes the message.
Update Guzzle to
2.12.x 2.12.1 -
medium CVE-2026-47767 Reviewed
Symfony Runtime: Web Requests Can Still Switch APP_ENV and APP_DEBUG
Lets an unauthenticated request change the app environment or debug mode on servers with register_argc_argv=On, bypassing the CVE-2024-50340 fix.
Update Symfony to
6.4.x 6.4.40 5.4.x 5.4.52+ 2 older releases
-
medium CVE-2026-53723 Reviewed
Guzzle Services: XML Injection in Outgoing Request Bodies
Lets user input add XML markup to request bodies in apps that use guzzle-services to send XML built from that input.
Update Guzzle to
1.5.x 1.5.4 -
medium CVE-2026-49208 Reviewed
Symfony UX Live Component: Date Props Accept Relative Dates
Lets a client move a writable date prop to any point in time, getting past date-based checks in live components.
Update Symfony UX to
3.1.x 3.1.0 2.36.x 2.36.0 -
low CVE-2026-49209 Reviewed
Symfony UX Live Component: Large Batch Requests Can Overload the Server
Lets a logged-in user tie up CPU, memory and database connections by sending one batch request with thousands of live actions.
Update Symfony UX to
3.1.x 3.1.0 2.36.x 2.36.0 -
low CVE-2026-49215 Reviewed
Symfony UX Live Component: LiveAction CSRF Check Can Be Bypassed
Lets another site trigger live actions in a user's session, in apps whose session cookies use SameSite=None.
Update Symfony UX to
3.1.x 3.1.0 2.36.x 2.36.0 -
medium CVE-2026-49210 Reviewed
Symfony UX Live Component: Cross-Site Scripting via Child Component Tag
Lets an attacker inject HTML into a live component re-render, mainly in apps that have relaxed CORS for the live component endpoint.
Update Symfony UX to
3.1.x 3.1.0 2.36.x 2.36.0 -
low CVE-2026-49212 Reviewed
Symfony UX Live Component: Signed Props Can Be Reused Across Components
Lets a client reuse signed read-only props from one live component in another whose prop names match, changing state it shouldn't.
Update Symfony UX to
3.1.x 3.1.0 2.36.x 2.36.0 -
medium CVE-2026-49216 Reviewed
Symfony UX Autocomplete: Stored Cross-Site Scripting in Dropdown Results
Lets an attacker run script in other users' browsers when autocomplete results come from content users can write.
Update Symfony UX to
3.1.x 3.1.0 2.36.x 2.36.0 -
medium CVE-2026-49211 Reviewed
Symfony UX Autocomplete: Wildcards Expose Unlisted Entity Data
Lets anyone probe every column of an entity through a public autocomplete endpoint by sending search wildcards.
Update Symfony UX to
3.1.x 3.1.0 2.36.x 2.36.0 -
medium CVE-2026-48808 Reviewed
Twig Sandbox: column Filter Reads Blocked Properties Under a Source Policy
Lets an untrusted template read blocked object properties with the column filter when the sandbox is set by a source policy.
Update Twig to
3.27.x 3.27.0 -
low CVE-2026-48805 Reviewed
Twig Sandbox: Deprecated Helper Functions Skip Sandbox Checks
Lets sandboxed templates get around callable checks through deprecated Twig helper functions still used by older third-party code.
Update Twig to
3.27.x 3.27.0 -
high CVE-2026-46636 Reviewed
Twig Sandbox: Allow-List Bypass When Sandbox State Changes
Lets an untrusted template use forbidden filters, tags and functions when one Twig environment renders both sandboxed and normal templates.
Update Twig to
3.27.x 3.27.0 -
medium CVE-2026-48806 Reviewed
Twig Sandbox: __toString() Bypass via Dynamic Mapping Keys
Lets an untrusted template call __toString() on objects the sandbox policy blocks, a leftover gap from the GHSA-pr2w-4gpj-cpq4 fix.
Update Twig to
3.27.x 3.27.0 -
medium CVE-2026-48807 Reviewed
Twig Sandbox: __toString() Bypass via join, replace and in
Lets an untrusted template call __toString() on objects the sandbox policy blocks, a leftover gap from the GHSA-pr2w-4gpj-cpq4 fix.
Update Twig to
3.27.x 3.27.0 -
medium CVE-2026-48736 Reviewed
Symfony HttpClient: IPv6 Transition Addresses Bypass Private Network Block
Lets an attacker reach private network hosts through NoPrivateNetworkHttpClient by using IPv6 addresses that wrap a private IPv4 address.
Update Symfony to
7.4.x 7.4.13 6.4.x 6.4.41 5.4.x 5.4.53+ 1 older release
-
medium CVE-2026-48761 Reviewed
Symfony HtmlSanitizer: Some URL Attributes Skip URL Checks
Lets javascript: and other blocked URLs through in attributes like object data, in apps that allow those attributes in HtmlSanitizer.
Update Symfony to
7.4.x 7.4.13 6.4.x 6.4.41+ 1 older release
-
medium CVE-2026-48784 Reviewed
Symfony Routing: Chained ../ in Parameters Escape Generated URLs
Can make URLs built by UrlGenerator point to a different path than intended when a route parameter holds a chain of ../ or ./ segments.
Update Symfony to
7.4.x 7.4.13 6.4.x 6.4.41 5.4.x 5.4.53+ 1 older release
-
medium CVE-2026-48747 Reviewed
Symfony Mailer Mailomat: Webhook Request Picks Its Own HMAC Algorithm
Lets a Mailomat webhook request choose a weak HMAC algorithm for its signature check, weakening webhook authentication.
Update Symfony to
7.4.x 7.4.13+ 1 older release
-
medium CVE-2026-48760 Reviewed
Symfony HtmlSanitizer: Encoded BiDi Marks Slip Past Link Spoofing Checks
Lets percent-encoded direction marks and Unicode spaces through HtmlSanitizer, so decoded links can be made to look like other domains.
Update Symfony to
7.4.x 7.4.13 6.4.x 6.4.41+ 1 older release
-
high CVE-2026-48489 Reviewed
Symfony Security: failure_forward Lets Anyone Reach Protected Pages
Lets an unauthenticated user load access_control-protected GET routes in apps that use form login with failure_forward turned on.
Update Symfony to
7.4.x 7.4.13 6.4.x 6.4.41 5.4.x 5.4.53+ 1 older release
-
low CVE-2026-46644 Reviewed
Symfony Polyfill IDN: Invalid xn-- Labels Treated as Normal Domains
Can let two different domain names compare as equal, getting past domain blocklists, on PHP installs without the intl extension.
Only affects branches that no longer get security fixes
-
medium CVE-2026-49214 Reviewed
guzzlehttp/psr7: Header Injection Through the URI Host
Lets an attacker inject HTTP headers when an app builds a psr7 request from a user URL and serializes it as raw HTTP.
Update Guzzle to
2.10.x 2.10.2 -
medium CVE-2026-48998 Reviewed
guzzlehttp/psr7: Crafted Host Header Changes the Request's Host
Lets an attacker make an incoming request's URI host differ from its Host header in apps that build server requests with guzzlehttp/psr7.
Update Guzzle to
2.10.x 2.10.2 -
low CVE-2026-45304 Reviewed
Symfony Yaml: Alias Expansion Can Use Up All Memory
Lets a small YAML document expand into gigabytes of data through aliases, in apps that parse untrusted YAML.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
medium CVE-2026-45068 Reviewed
Symfony Mailer: Recipient Addresses Can Become Sendmail Options
Lets a recipient address starting with a dash pass options to sendmail, in apps using SendmailTransport in -t mode.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
low CVE-2026-45305 Reviewed
Symfony Yaml: Crafted Header Line Makes the Parser Hang
Lets an attacker tie up the parser for a long time with one crafted YAML header or comment line, in apps that parse untrusted YAML.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
low CVE-2026-45753 Reviewed
Symfony HtmlSanitizer: javascript: URLs Survive in Form and Media Attributes
Can allow cross-site scripting through action, formaction, poster or cite attributes in apps that allow them in HtmlSanitizer.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40+ 1 older release
-
low CVE-2026-45071 Reviewed
Symfony DomCrawler: addXmlContent() Can Read Local Files
Can expose local server files when an app loads untrusted XML with Crawler::addXmlContent(), including pages fetched by HttpBrowser.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
medium CVE-2026-45754 Reviewed
Symfony Mailer Mailjet and LOX24: Webhook Secrets Are Never Checked
Lets anyone send fake email or SMS events to apps that use the Mailjet or LOX24 webhook parsers, even with a secret set.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40+ 1 older release
-
medium CVE-2026-47212 Reviewed
Symfony Twilio Notifier: Webhooks Accepted Without Checking Twilio's Signature
Lets anyone who finds a Twilio webhook endpoint send fake SMS status events, even when a webhook signing secret is configured.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40+ 1 older release
-
low CVE-2026-45756 Reviewed
Symfony JsonPath: User-Supplied Regex in match() or search() Can Stall Workers
Lets an attacker tie up CPU in apps that evaluate JSONPath expressions taken from user input with JsonCrawler.
Update Symfony to
7.4.x 7.4.12+ 1 older release
-
high CVE-2026-45077 Reviewed
Symfony server:log Command: Network Listener Unserializes Untrusted Data
Lets anyone who can reach port 9911 on a machine running server:log crash it or inject PHP objects, and in some setups run code.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
medium CVE-2026-45069 Reviewed
Symfony OidcTokenHandler: Tokens Without aud, iss or exp Claims Are Accepted
Lets a validly signed OpenID Connect token that leaves out its audience, issuer or expiry claim pass Symfony's OIDC token check.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40+ 1 older release
-
medium CVE-2026-45073 Reviewed
Symfony Cache PdoAdapter: SQL Injection Through the clear() Prefix
Allows SQL injection, such as deleting other rows, in apps that pass untrusted input as the prefix to PdoAdapter's clear() method.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
medium CVE-2026-45066 Reviewed
Symfony HtmlSanitizer: Malformed URLs Slip Past Link and Media Host Lists
Lets sanitized HTML link or load media from hosts outside allowLinkHosts() or allowMediaHosts() through URLs browsers read differently.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40+ 1 older release
-
medium CVE-2026-45064 Reviewed
Symfony HtmlSanitizer: Direction Marks in URLs Let Links Look Like Others
Lets sanitized links carry Unicode direction marks that make a link's shown address differ from where it really goes.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40+ 1 older release
-
medium CVE-2026-45755 Reviewed
Symfony Mailer Mailtrap: Webhook Signatures Are Never Checked
Lets anyone send fake delivery, bounce or click events to apps that use the Mailtrap webhook parser, even with a secret set.
Update Symfony to
7.4.x 7.4.12+ 1 older release
-
high CVE-2026-45063 Reviewed
Symfony X509 Login: Crafted Certificate Names Can Pose as Another User
Lets a client certificate holder log in as another user by hiding an email in the certificate name, in apps using X509Authenticator.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
medium CVE-2026-45065 Reviewed
Symfony Routing: Loose Route Requirements Let Links Point Off-Site
Lets a crafted parameter value pass a route requirement written as a list of options, so path() or url() builds a link to another host.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
medium CVE-2026-46626 Reviewed
Symfony Runtime: Web Requests Can Still Switch APP_ENV and APP_DEBUG
Lets an unauthenticated request change the app environment or debug mode on servers with register_argc_argv=On, bypassing the CVE-2024-50340 fix.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
high CVE-2026-45067 Reviewed
Symfony Mime: Line Breaks in Addresses Allow Email Header Injection
Lets an attacker add email headers or SMTP commands through a crafted address in apps that pass user addresses to Symfony Mailer.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
medium CVE-2026-45074 Reviewed
Symfony Security CAS: Tickets From Other Services Can Log In as the User
Lets an attacker who runs another app on the same CAS server log in as a victim, in apps using Cas2Handler without trusted_hosts.
Update Symfony to
7.4.x 7.4.12+ 1 older release
-
low CVE-2026-45133 Reviewed
Symfony Yaml: Deeply Nested YAML Crashes the Process
Lets an attacker crash the PHP worker with one deeply nested YAML document in apps that parse untrusted YAML.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
low CVE-2026-45072 Reviewed
Symfony Profiler: Stored Cross-Site Scripting in File Excerpts
Lets someone who can write to a project file, like a log, run script in a developer's browser when they view it in the profiler.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40+ 1 older release
-
high CVE-2026-45075 Reviewed
Symfony Security: HEAD Requests Skip Checks Limited to GET
Lets HEAD requests skip #[IsGranted], #[IsSignatureValid] and #[IsCsrfTokenValid] checks that set methods: ['GET'].
Update Symfony to
7.4.x 7.4.12+ 1 older release
-
high CVE-2026-46640 Reviewed
Twig: Code Execution Through Dynamic Macro References on _self
Lets anyone who can write a template run PHP code on the server, bypassing even a strict sandbox, in Twig 3.15 to 3.25.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46628 Reviewed
Twig: spaceless Filter Output Skips Autoescaping
Can allow cross-site scripting when templates apply the deprecated spaceless filter to user input with autoescape on.
Update Twig to
3.26.x 3.26.0 -
critical CVE-2026-46633 Reviewed
Twig: Code Execution Through a Crafted {% use %} Template Name
Lets anyone who can write a template, even a sandboxed one, run PHP code on the server through the {% use %} tag.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-47730 Reviewed
Twig Profiler: Cross-Site Scripting in HtmlDumper Output
Lets attacker-controlled template names inject HTML into Twig profiler dumps rendered with HtmlDumper.
Update Twig to
3.26.x 3.26.0 -
high CVE-2026-46639 Reviewed
Twig Sandbox: Object Destructuring Skips Property and Method Checks
Lets a sandboxed template read any public property or call any public getter through object destructuring, in Twig 3.24 and 3.25.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46627 Reviewed
Twig Sandbox: Untrusted Templates Can Use Unlimited CPU and Memory
Allows a sandboxed Twig template to use as much CPU, memory and time as it likes; Twig now documents limiting this at the process level.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46635 Reviewed
Twig Sandbox: column Filter Reads Blocked Object Properties
Lets an untrusted template read object properties the sandbox policy blocks, when the column filter is allowed.
Update Twig to
3.26.x 3.26.0 -
medium CVE-2026-46638 Reviewed
Twig Sandbox: {% sandbox %} Include Skips Checks on Cached Templates
Lets an included template use any tag, filter or function if it was loaded outside the sandbox first, through the {% sandbox %} tag.
Update Twig to
3.26.x 3.26.0 -
high CVE-2026-24425 Reviewed
Twig Sandbox: Callback Filters Accept Any PHP Callable Under a Source Policy
Lets a sandboxed template pass any PHP callable to sort, filter, map or reduce when the sandbox is set by a source policy.
Update Twig to
3.26.x 3.26.0+ 1 older release
-
high CVE-2026-47732 Reviewed
Twig Sandbox: Several Ways to Call Blocked __toString() Methods
Lets an untrusted template call __toString() on objects the sandbox policy blocks, through operators and expressions the sandbox didn't check.
Update Twig to
3.26.x 3.26.0 -
medium CVE-2026-46634 Reviewed
Twig Sandbox: template_from_string Escapes a Source Policy Sandbox
Lets a sandboxed template run any tag, filter or function when the sandbox is set by a source policy and template_from_string is allowed.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46637 Reviewed
Twig Extras: Some Filters Skip Escaping in Every Context
Can allow cross-site scripting when output from filters like html_to_markdown or markdown_to_html is used in templates without escaping.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46629 Reviewed
Twig Intl Extra: Formatter Cache Can Grow Without Limit
Lets a template use up memory outside memory_limit by passing many distinct formats to Twig's intl filters, mainly on long-running workers.
Update Twig to
3.26.x 3.26.0 -
high CVE-2026-45793 Reviewed
Composer: GitHub Tokens With Hyphens Printed in Full to CI Logs
Exposes GitHub Actions GITHUB_TOKEN values, and other GitHub tokens containing a hyphen, in Composer's error output and CI logs.
Update Composer to
2.9.x 2.9.8 1.10.x 1.10.28+ 1 older release
-
medium CVE-2026-7262
NULL pointer dereference in SOAP apache:Map decoder with missing <value>
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-7261
SoapServer session-persisted object use-after-free via SOAP header fault
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-6735
XSS within PHP-FPM status endpoint
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
high CVE-2026-6722
Use-After-Free in SOAP using Apache map with Remote Code Execution
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-7258
Out-of-bounds read in urldecode()
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-6104
Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 -
high CVE-2025-14179
SQL injection in pdo_firebird via NUL bytes in quoted strings
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
low CVE-2026-7568
Signed integer overflow in metaphone()
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
high CVE-2026-7263
DoS attack via DOMNode::C14N()
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 -
high CVE-2026-40261 Reviewed
Composer: Malicious Perforce Package Metadata Can Run Commands on Install
Lets a malicious or compromised package repository run commands when Composer installs packages from source, even without Perforce installed.
Update Composer to
2.9.x 2.9.6+ 1 older release
-
high CVE-2026-40176 Reviewed
Composer: Perforce Settings in an Untrusted composer.json Can Run Commands
Lets a malicious project's composer.json run commands on your machine when you run Composer in it, even without Perforce installed.
Update Composer to
2.9.x 2.9.6+ 1 older release
-
medium CVE-2026-24739 Reviewed
Symfony Process on Windows: Git Bash Can Mangle Arguments and Hit Wrong Paths
Can make file commands run through Symfony Process act on the wrong path, up to deleting a whole directory, when PHP runs from Git Bash.
Update Symfony to
7.4.x 7.4.5 6.4.x 6.4.33 5.4.x 5.4.51+ 2 older releases
-
low CVE-2025-67746 Reviewed
Composer: Remote Sources Can Inject Terminal Control Codes Into Output
Lets a source Composer downloads from inject ANSI control characters that garble Composer's terminal output.
Update Composer to
2.9.x 2.9.3+ 1 older release
-
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
medium CVE-2025-14180
NULL Pointer Dereference in PDO quoting
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
medium CVE-2025-14178
Heap buffer overflow in array_merge()
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
medium CVE-2025-14177
Information Leak of Memory in getimagesize
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
high CVE-2025-64500 Reviewed
Symfony HttpFoundation: Malformed Paths Can Slip Past Access Rules
Lets an attacker reach some URLs that path-based access rules should block, in apps whose rules assume every path starts with a slash.
Update Symfony to
6.4.x 6.4.29 5.4.x 5.4.50+ 1 older release
-
medium CVE-2025-1735
pgsql extension does not check for errors during escaping
Update PHP to
8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29+ 1 older release
-
medium CVE-2025-6491
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
Update PHP to
8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29+ 1 older release
-
low CVE-2025-1220
Null byte termination in hostnames
Update PHP to
8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29+ 1 older release
-
medium CVE-2025-47946 Reviewed
Symfony UX Twig Components: Unescaped Attributes Allow XSS
Lets an attacker inject HTML and script into pages that render component attributes holding user input with {{ attributes }}.
Update Symfony UX to
2.25.x 2.25.1 -
medium CVE-2024-11235
Reference counting in php_request_shutdown causes Use-After-Free
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 -
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1219
libxml streams use wrong `content-type` header when requesting a redirected resource
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1736
Stream HTTP wrapper header check might omit basic auth header
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1861
Stream HTTP wrapper truncate redirect location to 1024 bytes
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1734
Streams HTTP wrapper does not fail for headers with invalid name and no colon
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1217
Header parser of `http` stream wrapper does not handle folded headers
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-24374 Reviewed
Twig: Null Coalesce Operator Skips Output Escaping
Leaves the left side of a ?? expression unescaped in Twig templates, so user input there can carry HTML or script into the page.
Update Twig to
3.19.x 3.19.0 -
medium CVE-2025-21617 Reviewed
Guzzle OAuth Subscriber: Weak Nonces Can Allow Replayed OAuth 1 Requests
Generates weak OAuth 1 nonces, which can leave the servers your app calls open to replayed requests when the connection doesn't use TLS.
Update Guzzle to
0.8.x 0.8.1 -
high CVE-2024-8929
[Mysqlnd] Leak partial content of the heap through heap buffer over-read
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-8932
OOB access in ldap_escape
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-11234
Configuring a proxy in a stream context might allow for CRLF injection in URIs
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-11236
Integer overflow in the firebird and dblib quoters causing OOB writes
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-11233
Single byte overread with convert.quoted-printable-decode filter
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
high CVE-2024-51996 Reviewed
Symfony Remember-Me: Persistent Tokens Let a User Log In as Someone Else
Lets someone with a valid remember-me token log in as a different user in Symfony apps that store remember-me tokens with a token provider.
Update Symfony to
6.4.x 6.4.15 5.4.x 5.4.47+ 1 older release
-
low CVE-2024-50342 Reviewed
Symfony HttpClient: NoPrivateNetworkHttpClient Leaks Internal Hosts and Ports
Can let an attacker map internal IP addresses and ports through apps that fetch user-supplied URLs with NoPrivateNetworkHttpClient.
Update Symfony to
6.4.x 6.4.15 5.4.x 5.4.47+ 1 older release
-
low CVE-2024-51754 Reviewed
Twig Sandbox: __toString() Runs on Objects in Arrays Without a Check
Lets untrusted templates call __toString() on objects the sandbox policy blocks, when the object sits in an array or an argument list.
Update Twig to
3.14.x 3.14.1+ 1 older release
-
low CVE-2024-51755 Reviewed
Twig Sandbox: Array-Like Objects Skip the Security Policy
Lets untrusted templates read properties of ArrayAccess objects that the sandbox policy should block, in apps that run user templates in Twig's sandbox.
Update Twig to
3.14.x 3.14.1+ 1 older release
-
low CVE-2024-50345 Reviewed
Symfony HttpFoundation: Malformed URLs Can Slip Past Redirect Checks
Lets an attacker send users to another domain when an app checks redirect targets with the Request class, which parsed some URLs unlike browsers.
Update Symfony to
6.4.x 6.4.14 5.4.x 5.4.46+ 1 older release
-
high CVE-2024-51736 Reviewed
Symfony Process on Windows: A cmd.exe in the Working Directory Gets Run
Lets a cmd.exe file in the current working directory run instead of the real one when Symfony's Process class runs commands on Windows.
Update Symfony to
6.4.x 6.4.14 5.4.x 5.4.46+ 1 older release
-
medium CVE-2024-50340 Reviewed
Symfony Runtime: Query Strings Can Change the Environment and Debug Mode
Lets anyone switch the environment or debug mode of a Symfony app for a request, on servers where PHP's register_argc_argv is On.
Update Symfony to
6.4.x 6.4.14 5.4.x 5.4.46+ 1 older release
-
high CVE-2024-4577
PHP RCE: A Bypass of CVE-2012-1823, Argument Injection in PHP-CGI
Update PHP to
8.3.x 8.3.8 8.2.x 8.2.20+ 1 older release
-
medium CVE-2024-8927
cgi.force_redirect configuration is bypassable due to the environment variable collision
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
medium CVE-2024-8926
PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
low CVE-2024-8925
Erroneous parsing of multipart form data
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
low CVE-2024-9026
[PHP-FPM] Logs from childrens may be altered
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
medium CVE-2024-45411 Reviewed
Twig Sandbox: Templates Included in Sandbox Mode Can Skip Its Checks
Lets user-written templates escape sandbox rules when the sandbox is off globally and turned on only through a sandboxed include().
Update Twig to
3.14.x 3.14.0 2.16.x 2.16.0+ 2 older releases
-
low CVE-2024-50343 Reviewed
Symfony Validator: Values Ending in a Newline Pass Regex-Based Checks
Lets values with a trailing newline pass constraints such as Email, Url, Date and Time that Symfony checks with a regular expression.
Update Symfony to
6.4.x 6.4.11 5.4.x 5.4.43+ 1 older release
-
low CVE-2024-50341 Reviewed
Symfony Security::login() Skips the Firewall's Custom User Checker
Lets accounts a firewall's custom user_checker would reject log in anyway when the app logs them in with Security::login().
Update Symfony to
6.4.x 6.4.10+ 2 older releases
-
high CVE-2024-35241 Reviewed
Composer: Malicious Git Branch Names Can Run Code on status or remove
Lets a malicious package repository run commands on your machine when you run composer status, reinstall or remove on source installs.
Update Composer to
2.7.x 2.7.7+ 1 older release
-
high CVE-2024-35242 Reviewed
Composer: Malicious Git or Hg Branch Names Can Run Code on composer install
Lets an untrusted repository run commands on your machine when you clone it and run composer install inside it.
Update Composer to
2.7.x 2.7.7+ 1 older release
-
high CVE-2024-5585
bypass CVE-2024-1874
Update PHP to
8.3.x 8.3.8 8.2.x 8.2.20+ 1 older release
-
medium CVE-2024-5458
Filter bypass in filter_var (FILTER_VALIDATE_URL)
Update PHP to
8.3.x 8.3.8 8.2.x 8.2.20+ 1 older release
-
medium Reviewed
Symfony2 getClientIp(): Faked Client IPs Can Get Past IP-Based Access Rules
Lets a client fake their IP address in Symfony 2.0 and 2.1 apps that call Request::trustProxyData() and use getClientIp() for access control.
Only affects branches that no longer get security fixes
-
high Reviewed
Symfony 2.0: XML Entity Expansion Lets Small Documents Exhaust Memory
Lets an attacker use up a server's memory with one small XML document in Symfony 2.0 apps that parse untrusted XML.
Only affects branches that no longer get security fixes
-
high CVE-2024-2757
mb_encode_mimeheader runs endlessly for some inputs
Update PHP to
8.3.x 8.3.6 -
low CVE-2024-3096
password_verify can erroneously return true, opening ATO risk
Update PHP to
8.3.x 8.3.6 8.2.x 8.2.18+ 1 older release
-
critical CVE-2024-1874
Command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows
Update PHP to
8.3.x 8.3.6 8.2.x 8.2.18+ 1 older release
-
medium CVE-2024-2756
__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
Update PHP to
8.3.x 8.3.6 8.2.x 8.2.18+ 1 older release
-
high CVE-2024-24821 Reviewed
Composer: Tampered vendor/composer Files Run Code When Composer Runs
Lets code planted in a project's vendor/composer files run as whoever runs Composer there, including root when Composer runs with sudo.
Update Composer to
2.7.x 2.7.0+ 1 older release
-
medium CVE-2023-46735 Reviewed
Symfony Webhook: WebhookController Error Message Allows XSS
Lets an attacker craft a link that runs JavaScript on your site through the Webhook component's error response, in Symfony 6.3 before 6.3.8.
Only affects branches that no longer get security fixes
-
medium CVE-2023-46733 Reviewed
Symfony Security: Session ID Not Renewed When a Partial Login Completes
Allows session fixation, because the session ID wasn't regenerated when a partly authenticated login became fully authenticated.
Update Symfony to
5.4.x 5.4.31+ 1 older release
-
medium CVE-2023-46734 Reviewed
Symfony Twig Bridge: CodeExtension Filters Can Output Unescaped HTML
Allows cross-site scripting when untrusted input reaches some CodeExtension Twig filters, which marked their output safe without escaping it.
Update Symfony to
5.4.x 5.4.31+ 2 older releases
-
high CVE-2023-43655 Reviewed
Composer: A Web-Accessible composer.phar Can Let Attackers Run Code
Lets an attacker run code on a server that publishes composer.phar where PHP executes it and register_argc_argv is enabled.
Update Composer to
2.6.x 2.6.4 1.10.x 1.10.27+ 1 older release
-
medium CVE-2023-41336 Reviewed
Symfony UX Autocomplete: Fields Accept Entities Outside query_builder
Lets a user submit an entity the field's custom query_builder should exclude, in EntityType fields that use autocomplete.
Update Symfony UX to
2.11.x 2.11.2 -
low CVE-2023-3247
Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
Update PHP to
8.2.x 8.2.7+ 1 older release
-
medium CVE-2023-29197 Reviewed
Guzzle PSR-7: Newlines Allowed in Header Names and Values
Allows header injection when untrusted input containing a newline ends up in header names or values built with guzzlehttp/psr7.
Update Guzzle to
2.4.x 2.4.5 1.9.x 1.9.1 -
low CVE-2023-0567
BCrypt hashes erroneously validate if the salt is cut short by `$`
Update PHP to
8.2.x 8.2.3+ 1 older release
-
high CVE-2023-0662
DoS vulnerability when parsing multipart request body
Update PHP to
8.2.x 8.2.3+ 1 older release
-
medium CVE-2022-24894 Reviewed
Symfony HttpCache: Session Cookies Can Be Cached and Served to Others
Can leak one user's session cookie to other visitors in apps that run Symfony's HttpCache reverse proxy.
Update Symfony to
5.4.x 5.4.20+ 4 older releases
-
medium CVE-2022-24895 Reviewed
Symfony Security: CSRF Tokens Survive Login, Allowing Token Fixation
Lets a same-site attacker get past CSRF protection, because CSRF tokens stored in the session were kept when a user logged in.
Update Symfony to
5.4.x 5.4.20+ 4 older releases
-
high CVE-2022-39261 Reviewed
Twig Filesystem Loader: Template Names Can Reach Files Outside Its Directories
Lets an attacker read files outside the template directories in apps that pass user input as a template name to the filesystem loader.
Update Twig to
3.4.x 3.4.3 2.15.x 2.15.3+ 1 older release
-
high CVE-2022-31091
Change in port should be considered a change in origin
Update Guzzle to
7.4.x 7.4.5 6.5.x 6.5.8 -
high CVE-2022-31090
CURLOPT_HTTPAUTH option not cleared on change of origin
Update Guzzle to
7.4.x 7.4.5 6.5.x 6.5.8 -
high CVE-2022-31043
Fix failure to strip Authorization header on HTTP downgrade
Update Guzzle to
7.4.x 7.4.4 6.5.x 6.5.7 -
high CVE-2022-31042
Failure to strip the Cookie header on change in host or HTTP downgrade
Update Guzzle to
7.4.x 7.4.4 6.5.x 6.5.7 -
high CVE-2022-29248
Cross-domain cookie leakage
Update Guzzle to
7.4.x 7.4.3 6.5.x 6.5.6 -
high CVE-2018-14774
Symfony Host Header Injection
No fixed release listed yet
-
high CVE-2022-24828
Missing input validation can lead to command execution in composer
Update Composer to
2.3.x 2.3.5 1.10.x 1.10.26+ 1 older release
-
medium CVE-2022-24775
Inproper parsing of HTTP headers
Update Guzzle to
2.1.x 2.1.1 1.8.x 1.8.4 -
high CVE-2022-23614
Disallow non closures in the sort filter
Update Twig to
3.3.x 3.3.8 2.14.x 2.14.11 -
high CVE-2022-23601
CVE-2022-23601: CSRF token missing in forms
Update Symfony to
5.4.x 5.4.4+ 2 older releases
-
medium CVE-2021-41270
CVE-2021-41270: Prevent CSV Injection via formulas
Only affects branches that no longer get security fixes
-
critical CVE-2021-43608
SQL Injection in Limit Clause Generation API
Update Doctrine to
3.1.x 3.1.4+ 1 older release
-
medium CVE-2021-41268
CVE-2021-41268: Remember me cookie persistance after password changes
Only affects branches that no longer get security fixes
-
medium CVE-2021-41267
CVE-2021-41267: Webcache Poisoning via X-Forwarded-Prefix and sub-request
Only affects branches that no longer get security fixes
-
high CVE-2021-41116
Improper escaping of command arguments on Windows leading to command injection
Update Composer to
2.1.x 2.1.9 1.10.x 1.10.23 -
medium CVE-2021-32693
CVE-2021-32693: Authentication granted to all firewalls instead of just one
Only affects branches that no longer get security fixes
-
medium CVE-2021-21424
CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms
Update MakerBundle to
1.31.x 1.31.1+ 7 older releases
-
high CVE-2021-29472
Missing argument delimiter can lead to command execution via VCS repository URLs or source download URLs on systems with Mercurial
Update Composer to
2.0.x 2.0.13 1.10.x 1.10.22 -
Update Doctrine to
2.8.x 2.8.4 -
high CVE-2020-15094
CVE-2020-15094: Prevent RCE when calling untrusted remote with CachingHttpClient
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
medium CVE-2020-5274
CVE-2020-5274: Fix Exception message escaping rendered by ErrorHandler
Only affects branches that no longer get security fixes
-
high CVE-2020-5275
CVE-2020-5275: All rules set in "access_control" are required when the firewall is configured with the unanimous strategy
Only affects branches that no longer get security fixes
-
high CVE-2019-18888
CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser
Only affects branches that no longer get security fixes
-
critical CVE-2019-11325
CVE-2019-11325: Fix escaping of strings in VarExporter
Only affects branches that no longer get security fixes
-
high CVE-2019-18887
CVE-2019-18887: Use constant time comparison in UriSigner
Only affects branches that no longer get security fixes
-
medium CVE-2019-18886
CVE-2019-18886: Prevent user enumeration using switch user functionality
Only affects branches that no longer get security fixes
-
critical CVE-2019-18889
CVE-2019-18889: Forbid serializing AbstractAdapter and TagAwareAdapter instances
Only affects branches that no longer get security fixes
-
critical CVE-2019-10910
CVE-2019-10910: Check service IDs are valid
Only affects branches that no longer get security fixes
-
medium CVE-2019-10909
CVE-2019-10909: Escape validation messages in the PHP templating engine
Update Symfony to
8.6.x 8.6.14 7.65.x 7.65+ 6 older releases
-
high CVE-2019-10912
CVE-2019-10912: Prevent destructors with side-effects from being unserialized
Only affects branches that no longer get security fixes
-
high CVE-2019-10911
CVE-2019-10911: Add a separator in the remember me cookie hash
Only affects branches that no longer get security fixes
-
critical CVE-2019-10913
CVE-2019-10913: Reject invalid HTTP method overrides
Only affects branches that no longer get security fixes
-
low CVE-2019-9942
Sandbox Information Disclosure
Update Twig to
2.7.x 2.7.0 1.38.x 1.38.0 -
medium CVE-2018-19790
CVE-2018-19790: Open Redirect Vulnerability on login
Only affects branches that no longer get security fixes
-
medium CVE-2018-19789
CVE-2018-19789: Temporary uploaded file path disclosure
Only affects branches that no longer get security fixes
-
medium CVE-2018-14773
CVE-2018-14773: Remove support for legacy and risky HTTP headers
Only affects branches that no longer get security fixes
-
critical CVE-2018-11407
CVE-2018-11407: Unauthorized access on a misconfigured LDAP server when using an empty password
Only affects branches that no longer get security fixes
-
medium CVE-2018-11386
CVE-2018-11386: Denial of service when using PDOSessionHandler
Only affects branches that no longer get security fixes
-
high CVE-2018-11406
CVE-2018-11406: CSRF Token Fixation
Only affects branches that no longer get security fixes
-
high CVE-2018-11385
CVE-2018-11385: Session Fixation Issue for Guard Authentication
Only affects branches that no longer get security fixes
-
medium CVE-2018-11408
CVE-2018-11408: Open redirect vulnerability on security handlers
Only affects branches that no longer get security fixes
-
high CVE-2017-16654
CVE-2017-16654: Intl bundle readers breaking out of paths
Only affects branches that no longer get security fixes
-
medium CVE-2017-16652
CVE-2017-16652: Open redirect vulnerability on security handlers
Only affects branches that no longer get security fixes
-
medium CVE-2017-16790
CVE-2017-16790: Ensure that submitted data are uploaded files
Only affects branches that no longer get security fixes
-
medium CVE-2017-16653
CVE-2017-16653: CSRF protection does not use different tokens for HTTP and HTTPS
Only affects branches that no longer get security fixes
-
critical CVE-2017-11365
CVE-2017-11365: Empty passwords validation issue
Only affects branches that no longer get security fixes
-
high CVE-2016-5385
HTTP Proxy header vulnerability
Update Guzzle to
8.1.x 8.1.7 6.2.x 6.2.1 5.3.x 5.3.1+ 1 older release
-
critical CVE-2016-2403
CVE-2016-2403: Unauthorized access on a misconfigured Ldap server when using an empty password
Only affects branches that no longer get security fixes
-
high CVE-2016-4423
CVE-2016-4423: Large username storage in session
Only affects branches that no longer get security fixes
-
high CVE-2015-8371
Composer Cache Injection vulnerability
Update Composer to
1.0.x 1.0.0-beta1 -
high CVE-2016-1902
CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails
Only affects branches that no longer get security fixes
-
low CVE-2015-8124
CVE-2015-8124: Session Fixation in the "Remember Me" Login Feature
Only affects branches that no longer get security fixes
-
high CVE-2015-8125
CVE-2015-8125: Potential Remote Timing Attack Vulnerability in Security Remember-Me Service
Only affects branches that no longer get security fixes
-
high CVE-2015-5723
Security Misconfiguration Vulnerability in various Doctrine projects
Update Doctrine to
3.0.x 3.0.1 2.5.x 2.5.1+ 7 older releases
-
high CVE-2015-7809
Remote code execution in templates
Update Twig to
1.20.x 1.20.0 -
medium CVE-2015-4050
CVE-2015-4050: ESI unauthorized access
Only affects branches that no longer get security fixes
-
medium CVE-2015-2309
Unsafe methods in the Request class
Only affects branches that no longer get security fixes
-
medium CVE-2015-2308
Esi Code Injection
Only affects branches that no longer get security fixes
-
high CVE-2014-6072
CSRF vulnerability in the Web Profiler
Only affects branches that no longer get security fixes
-
high CVE-2014-5245
Direct access of ESI URLs behind a trusted proxy
Only affects branches that no longer get security fixes
-
medium CVE-2014-6061
Security issue when parsing the Authorization header
Only affects branches that no longer get security fixes
-
high CVE-2014-5244
Denial of service with a malicious HTTP Host header
Only affects branches that no longer get security fixes
-
high CVE-2014-4931
Code injection in the way Symfony implements translation caching in FrameworkBundle
Only affects branches that no longer get security fixes
-
medium CVE-2013-5958
Possible DOS attack with long user-submitted passwords
Only affects branches that no longer get security fixes
-
medium CVE-2013-4752
Request::getHost() poisoning
Only affects branches that no longer get security fixes
-
high CVE-2013-4751
Validation metadata serialization and loss of information
Only affects branches that no longer get security fixes
-
Update Doctrine to
0.7.x 0.7.2 -
Update Twig to
1.12.x 1.12.3 -
high CVE-2013-1397
Ability to enable/disable object support in YAML parsing and dumping
Only affects branches that no longer get security fixes
-
high CVE-2013-1348
Ability to enable/disable PHP parsing in Yaml::parse()
Only affects branches that no longer get security fixes
-
medium CVE-2012-6432
Code execution vulnerability via the "internal" routes
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
medium CVE-2012-6431
Routes behind a firewall are accessible even when not logged in
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
Update Doctrine to
2.1.x 2.1.2+ 2 older releases