CVE-2026-48784 Details
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters to generate URLs that collapse to a different path under RFC 3986 normalization. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
A vulnerability exists in the Symfony framework's UrlGenerator component, specifically in the doGenerate() method, prior to versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13. The issue arises from improper handling of dot-segment encoding in URL generation, which can be exploited to manipulate route parameters. The encoding method used, strtr(), failed to correctly process chained '../' or './' segments, allowing attacker-controlled inputs to generate URLs that, after normalization according to RFC 3986, resolved to unintended paths. This flaw can disrupt route integrity, particularly when routes accept dots and slashes in parameters.
Users can update to Symfony versions 5.4.53, 6.4.41, 7.4.13, or 8.0.13 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/symfony/symfony/commit/4b63c3a3f7af04ecd79c89a594b0b02a01990b1d | [email protected] | Patch |
| https://github.com/symfony/symfony/releases/tag/v5.4.53 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/releases/tag/v6.4.41 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/releases/tag/v7.4.13 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/security/advisories/GHSA-h5x3-xfc9-m39h | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-172 | Encoding Error | [email protected] |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sensiolabs symfony | < 5.4.53 >= 6.0.0, < 6.4.41 >= 7.0.0, < 7.4.13 >= 8.0.0, < 8.0.13 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |