PHP security advisories

Symfony Validator: Ip Constraint Accepts Some Internal Addresses as Public

Lets internal addresses pass #[Assert\Ip] public or no-private checks, getting past SSRF guards built on the Ip constraint.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony: private_ranges Trusted Proxies Setting Trusts Some Remote Clients

Lets some IPv6 clients pass as trusted proxies and set X-Forwarded headers in apps that use trusted_proxies: private_ranges.

Fixed in 8.1.11 and 7.4.23

Symfony HttpFoundation: Crafted Links Make Generated URLs Point Elsewhere

Lets a crafted link make an app's links, forms and redirects point to another host, when its front controller sits in a subdirectory.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony Serializer: Nested Properties Marked #[Ignore] Can Still Be Set

Lets a client set #[Ignore] properties on nested objects in apps that deserialize input with ObjectNormalizer, such as #[MapRequestPayload].

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56 · 1 older release

Symfony HtmlSanitizer: Meta Refresh URLs Slip Past Link Checks

Lets meta refresh tags send visitors to blocked hosts or javascript: URLs in apps that allow meta refresh through HtmlSanitizer.

Fixed in 8.1.11, 7.4.23 and 6.4.50

Symfony JsonPath: Crafted Queries Can Still Tie Up a Worker

Lets an attacker keep a PHP worker busy for minutes in apps that run JSONPath queries an attacker can influence, despite the CVE-2026-45756 fix.

Fixed in 8.1.11 and 7.4.23

Doctrine MongoDB ODM: Encrypted Fields Can Be Stored as Plain Text

Can store fields marked #[Encrypt] unencrypted in MongoDB collections that mix a class's own encrypted fields with encrypted embedded documents.

Fixed in 2.17.3

Symfony Mime: Header Injection Through Mime Parameter Names

Lets an attacker add extra email headers in apps that build a Content-Type or Content-Disposition parameter name from user input.

Fixed in 8.1.10, 7.4.22, 6.4.49 and 5.4.55

Laravel: Relationship Includes on Read Endpoints Can Destroy Data

Lets a user with only read access trigger a destructive query, such as emptying a related table, through relationship includes in some Laravel apps.

Fixed in 13.27.0 and 12.68.0

Symfony ExpressionLanguage: Deeply Nested Expressions Crash PHP

Lets an attacker crash the PHP process with one request in apps that parse or validate expressions written by users.

Fixed in 8.1.9, 7.4.21, 6.4.48 and 5.4.54

Composer: Malicious Package Can Change File Permissions Outside Vendor

Lets a malicious dependency make a file outside its own folder readable and runnable by anyone, getting around the earlier GHSA-gjfg-22fp-rrxx fix.

Fixed in 2.10.3 · 1 older release

Guzzle: Cookies for Numeric or Escaped Domains Leak to Other Hosts

Can leak cookies set for an IP-style Domain to other hosts in apps that use Guzzle's cookie jar, exposing session ids or tokens.

Fixed in 8.0.1 and 7.15.2

guzzlehttp/psr7: Malformed URI Hosts Can Fool Host Checks

Lets an attacker get past host allowlists or SSRF checks in apps that build a psr7 Uri from user input and trust getHost().

Fixed in 2.12.3

Guzzle: Redirects Can Leak URL Fragments in the Referer Header

Can leak secrets kept in a URL fragment to a redirect target, in apps that turn on Guzzle's referer redirect option.

Fixed in 7.15.1

Guzzle: Host-Only Cookies Are Sent to Subdomains

Can send a parent host's session cookies to its subdomains in apps that reuse one Guzzle cookie jar across hosts.

Fixed in 7.15.1

Guzzle: Malicious Server Can Flood the Cookie Jar

Lets a malicious server fill Guzzle's cookie jar with large cookies, using memory and breaking later requests that share the jar.

Fixed in 7.15.1

Guzzle: Cookies Set for IP Addresses Leak to Look-Alike Hosts

Can send cookies scoped to an IP address to other hosts, or let those hosts plant cookies, in apps that use Guzzle's cookie jar.

Fixed in 7.12.3

Composer: Malicious Package Can Make Private Files World-Readable

Lets a malicious dependency change permissions on files outside its folder, making private files such as SSH keys readable by other users.

Fixed in 2.10.2 · 1 older release

Composer: Tokens in Repository URLs Leak Into -vvv Debug Logs

Exposes access tokens placed in the username part of a repository URL to anyone who can read Composer's -vvv debug output.

Fixed in 2.10.2 · 1 older release

Guzzle: Proxy Credentials Can Be Sent to the Destination Server

Can send Proxy-Authorization credentials to the target server when a request skips the HTTP proxy, with Guzzle's cURL handlers.

Fixed in 7.14.2