CVE-2026-45064

Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing

Published Jul 14, 2026 CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse() passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized content to display a link destination that visually differs from the actual destination and enabling phishing-style visual spoofing. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

Analysis

Technical impact

UrlSanitizer::parse() in Symfony's HtmlSanitizer component passes Unicode explicit‑direction BiDi formatting characters into sanitized href and src attributes, letting sanitized content display a link destination that visually differs from its actual destination. This creates phishing‑style visual spoofing for releases from 6.1.0‑BETA1 through 6.4.40, 7.4.12, and 8.0.12. The issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12. The weakness is represented by CWE‑1007 and CWE‑451.

Affected Systems

The flaw affects the Symfony framework and its HtmlSanitizer component in versions from 6.1.0‑BETA1 through 6.4.40, from 7.4.12, and from 8.0.12. Users running any of these releases without applying the patch are susceptible, while later releases (6.4.40 or newer, 7.4.12 or newer, 8.0.12 or newer) contain the fix.

Risk and Exploitability

With a CVSS score of 2.3 and an EPSS score of less than 1%, the likelihood of exploitation is low and it is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply crafted HTML that includes invisible BiDi characters in URL attributes, typically achieved via injection or template abuse. Successful exploitation leads to deceptive user clicks and potential credential theft rather than code execution or system compromise.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

symfony

affected

Version	Status	Constraints
`>= 6.1.0-BETA1, < 6.4.40`	affected	—
`>= 7.0.0-BETA1, < 7.4.12`	affected	—
`>= 8.0.0-BETA1, < 8.0.12`	affected	—

symfony

html-sanitizer

affected

Version	Status	Constraints
`>= 6.1.0-BETA1, < 6.4.40`	affected	—
`>= 7.0.0-BETA1, < 7.4.12`	affected	—
`>= 8.0.0-BETA1, < 8.0.12`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:sensiolabs:symfony::::::::
	cpe:2.3:a:sensiolabs:symfony::::::::
	cpe:2.3:a:sensiolabs:symfony::::::::

No data.

Vendor Product Versions

Symfony

Html-sanitizer

Version	Status	Scheme	Platform
`[6.1.0-BETA1,6.4.40)`	affected	semver	—
`[7.0.0-BETA1,7.4.12)`	affected	semver	—
`[8.0.0-BETA1,8.0.12)`	affected	semver	—

Symfony

Version	Status	Scheme	Platform
`[6.1.0-BETA1,6.4.40)`	affected	semver	—
`[7.0.0-BETA1,7.4.12)`	affected	semver	—
`[8.0.0-BETA1,8.0.12)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Symfony framework and HtmlSanitizer component to version 6.4.40 or newer, 7.4.12 or newer, or 8.0.12 or newer, which contain the official fix.
Configure the HtmlSanitizer to strip Unicode explicit‑direction BiDi formatting if such a setting is available.
Validate user‑submitted URLs to remove or encode invisible BiDi characters before they are passed to the sanitizer.

Generated by OpenCVE AI on August 1, 2026 at 09:22 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6312-1	symfony security update
Github GHSA	GHSA-h5vq-qfcg-4m6p	Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.338% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/symfony/symfony/commit/743a435e948b897ef2b5564ac438d4beb95d2526
https://github.com/symfony/symfony/releases/tag/v6.4.40
https://github.com/symfony/symfony/releases/tag/v7.4.12
https://github.com/symfony/symfony/releases/tag/v8.0.12
https://github.com/symfony/symfony/security/advisories/GHSA-h5vq-qfcg-4m6p

History

Aug 5, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Symfony Symfony html-sanitizer Symfony symfony
Vendors & Products		Symfony Symfony html-sanitizer Symfony symfony

Jul 21, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 7:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse() passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized content to display a link destination that visually differs from the actual destination and enabling phishing-style visual spoofing. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Title		Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
Weaknesses		CWE-1007 CWE-451
References		https://github.com/symfony/symfony/commit/743a435e948b897ef2b5564ac438d4beb95d2526 https://github.com/symfony/symfony/releases/tag/v6.4.40 https://github.com/symfony/symfony/releases/tag/v7.4.12 https://github.com/symfony/symfony/releases/tag/v8.0.12 https://github.com/symfony/symfony/security/advisories/GHSA-h5vq-qfcg-4m6p
Metrics		cvssV4_0 `{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`