Symfony vulnerabilities
66 CVEs and advisories name Symfony as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-45753Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)
- CVE-2026-45072Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
- CVE-2026-45756Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
- CVE-2026-45066Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
- CVE-2026-45074Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
- CVE-2026-45077Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
- CVE-2026-45065Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
- CVE-2026-45067Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
- CVE-2026-55877Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses
- CVE-2026-55878Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest
- CVE-2026-24739Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operations
- CVE-2025-64500Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
- CVE-2025-47946symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes
- CVE-2024-51996Symphony has an Authentication Bypass via RememberMe
- CVE-2024-50340Ability to change environment from query in symfony/runtime
- CVE-2024-50341Security::login does not take into account custom user_checker in symfony/security-bundle
- CVE-2024-50342Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client
- CVE-2024-50343Incorrect response from Validator when input ends with `\n` in symfony/validator
- CVE-2024-50345Open redirect via browser-sanitized URLs in symfony/http-foundation
- CVE-2024-51736Command execution hijack on Windows with Process class in symfony/process
- CVE-2023-46735Symfony potential Cross-site Scripting in WebhookController
- CVE-2023-46734Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters
- CVE-2023-46733Symfony possible session fixation vulnerability
- CVE-2023-41336Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete
- CVE-2022-24894Symfony storing cookie headers in HttpCache
- CVE-2022-24895Symfony vulnerable to Session Fixation of CSRF tokens
- CVE-2022-23601CSRF token missing in Symfony
- CVE-2021-41270CSV Injection in Symfony
- CVE-2021-41267Webcache Poisoning in Symfony
- CVE-2021-41268Cookie persistence in Symfony