CVE-2026-48747

MediumCVSS 5.3/10Last modified Jul 15, 2026

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSignature() parsed X-MOM-Webhook-Signature as algo=signature and passed the request-selected algorithm to hash_hmac(), allowing a signature algorithm downgrade instead of enforcing Mailomat's documented SHA-256 webhook signature. This issue is fixed in versions 7.4.13 and 8.0.13.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-347 CWE-757

Affected software

Vendor	Product	Versions
symfony	symfony	>= 7.2.0, < 7.4.12; >= 8.0.0-BETA1, < 8.0.13
symfony	mailomat-mailer	>= 7.2.0, < 7.4.12; >= 8.0.0-BETA1, < 8.0.13

References

https://github.com/symfony/symfony/commit/bdfe9fe0d94d33dfaca0bc2fe0b00b54767b0c88Patch
https://github.com/symfony/symfony/releases/tag/v7.4.13Product, Release Notes
https://github.com/symfony/symfony/releases/tag/v8.0.13Product, Release Notes
https://github.com/symfony/symfony/security/advisories/GHSA-rrj9-5q2j-4gvrPatch, Vendor Advisory

Timeline

Published: Jul 14, 2026
Last modified: Jul 15, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-487487.5Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to versi CVE-2026-487499.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/wri CVE-2026-48754.7A vulnerability was determined in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /a CVE-2026-487509.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec CVE-2026-487519.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlev CVE-2026-487529.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to CVE-2026-487539.9Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path trave CVE-2026-487542.1Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/CVE-2026-487559.9Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression alg CVE-2026-487562.1Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/serv CVE-2026-487585.4sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/CVE-2026-487597.1TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace