CVE-2026-48761

MediumCVSS 6.1/10Last modified Jul 21, 2026

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-1023

Affected software

Vendor	Product	Versions
symfony	symfony	>= 6.1.0, < 6.4.41; >= 7.0.0-BETA1, < 7.4.13; >= 8.0.0-BETA1, < 8.0.13
symfony	html-sanitizer	>= 6.1.0, < 6.4.41; >= 7.0.0-BETA1, < 7.4.13; >= 8.0.0-BETA1, < 8.0.13

References

https://github.com/symfony/symfony/commit/069a70f9f26e61e9de3b7f9a864a86ed24b36bd0Patch
https://github.com/symfony/symfony/releases/tag/v6.4.41Product, Release Notes
https://github.com/symfony/symfony/releases/tag/v7.4.13Product, Release Notes
https://github.com/symfony/symfony/releases/tag/v8.0.13Product, Release Notes
https://github.com/symfony/symfony/security/advisories/GHSA-x5qj-865h-mgvmPatch, Vendor Advisory

Timeline

Published: Jul 14, 2026
Last modified: Jul 21, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-487625.4TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio U CVE-2026-487638.2TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/typebots/{typebotId}/CVE-2026-487648.2TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation is implemented by resolving a hostname once and checking whe CVE-2026-487659.9TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credential CVE-2026-487667.6TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-co CVE-2026-487677.6TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets CVE-2026-487689.3TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and CVE-2026-487699.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a m CVE-2026-48774.3A security flaw has been discovered in itsourcecode Payroll Management System up to 1.0. This affects an unknown function of the file /index CVE-2026-487705.0Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a CVE-2026-487718.2ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secu CVE-2026-4877210.0ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL frontend accepts the