CVE-2026-45753

Published: Jul 14, 2026Modified: Jul 15, 2026

2.1

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes() omits URL-valued attributes including action, formaction, poster, and cite, so configurations that admit those attributes can leave javascript: URIs unsanitized and enable XSS when the resulting HTML is rendered or a victim submits a form or clicks a button. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

Affected (3)

Products: Sensiolabs: Symfony

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Sensiolabs Symfony	From 6.1.0 to 6.4.40
Sensiolabs Symfony	From 7.0.0 to 7.4.12
Sensiolabs Symfony	From 8.0.0 to 8.0.12

Related CWEs

Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (5)

https://github.com/symfony/symfony/commit/487728e7e180a674a6d4c01bd0cb56161cc441b7

Source: security-advisories@github.com

Patch

https://github.com/symfony/symfony/releases/tag/v6.4.40

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/symfony/symfony/releases/tag/v7.4.12

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/symfony/symfony/releases/tag/v8.0.12

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/symfony/symfony/security/advisories/GHSA-hhg7-c65m-h7ff

Source: security-advisories@github.com

PatchVendor Advisory

Timeline

No history available yet.