PHP security advisories

Symfony HtmlSanitizer: Hostless URLs Slip Past Link and Media Host Lists

Lets links or media point to hosts outside allowLinkHosts() or allowMediaHosts() when allowRelativeLinks or allowRelativeMedias is on.

Fixed in 8.1.11, 7.4.23 and 6.4.50

Symfony HttpFoundation: Paths Glued to index.php Bypass Web Server Path Rules

Lets requests get past nginx, Apache, CDN or WAF rules on a path like /admin, while Symfony still routes them to that path.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony Security: Programmatic Logins Skip checkPostAuth() User Checks

Lets accounts a user checker rejects in checkPostAuth(), such as expired ones, log in through Security::login() or authenticateUser().

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony HtmlSanitizer: srcset Images Skip Media Scheme and Host Checks

Lets sanitized HTML load images from hosts outside allowMediaHosts() through srcset or imagesrcset attributes.

Fixed in 8.1.11, 7.4.23 and 6.4.50

Symfony Config: XmlUtils::parse() Resolves External Entities in Untrusted XML

Can reveal whether server files exist, or leak them through network stream wrappers, in apps that pass untrusted XML to XmlUtils::parse().

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony HttpKernel: Inline Fragments Let Forwarded Headers Change URLs

Lets client headers set the host of absolute URLs after an inline fragment renders, in apps reached from 127.0.0.1 without it as a trusted proxy.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56 · 2 older releases

Symfony HttpClient: DNS Rebinding Lets NoPrivateNetworkHttpClient Probe Ports

Lets an attacker who controls a host's DNS probe internal hosts and ports through repeated NoPrivateNetworkHttpClient requests to that host.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Laravel Debug Page: Cross-Site Scripting When APP_DEBUG Is On

Lets an attacker run script in a visitor's browser through the Laravel debug error page, when APP_DEBUG=true and the visitor hovers a tooltip.

Fixed in 13.30.0 and 12.69.0

Symfony UX Live Component: Large Batch Requests Can Overload the Server

Lets a logged-in user tie up CPU, memory and database connections by sending one batch request with thousands of live actions.

Fixed in 3.1.0 and 2.36.0

Symfony UX Live Component: LiveAction CSRF Check Can Be Bypassed

Lets another site trigger live actions in a user's session, in apps whose session cookies use SameSite=None.

Fixed in 3.1.0 and 2.36.0

Symfony UX Live Component: Signed Props Can Be Reused Across Components

Lets a client reuse signed read-only props from one live component in another whose prop names match, changing state it shouldn't.

Fixed in 3.1.0 and 2.36.0

Twig Sandbox: Deprecated Helper Functions Skip Sandbox Checks

Lets sandboxed templates get around callable checks through deprecated Twig helper functions still used by older third-party code.

Fixed in 3.27.0

Symfony Polyfill IDN: Invalid xn-- Labels Treated as Normal Domains

Can let two different domain names compare as equal, getting past domain blocklists, on PHP installs without the intl extension.

Only affects branches that no longer get security fixes

Twig Sandbox: Untrusted Templates Can Use Unlimited CPU and Memory

Allows a sandboxed Twig template to use as much CPU, memory and time as it likes; Twig now documents limiting this at the process level.

Fixed in 3.26.0

Twig: spaceless Filter Output Skips Autoescaping

Can allow cross-site scripting when templates apply the deprecated spaceless filter to user input with autoescape on.

Fixed in 3.26.0

Twig Intl Extra: Formatter Cache Can Grow Without Limit

Lets a template use up memory outside memory_limit by passing many distinct formats to Twig's intl filters, mainly on long-running workers.

Fixed in 3.26.0

Twig Profiler: Cross-Site Scripting in HtmlDumper Output

Lets attacker-controlled template names inject HTML into Twig profiler dumps rendered with HtmlDumper.

Fixed in 3.26.0