CVE-2026-48761

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content

View on CVE.org

Published Jul 14, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.

Analysis

Technical impact

The UrlAttributeSanitizer component in Symfony omitted URL-bearing attributes on several HTML tags—<object>, <applet>, <iframe>, and <img>—and failed to sanitize URLs included in the content of <meta http-equiv='refresh'> elements. This oversight allows malicious URLs such as javascript:payload to be inserted into enabled elements or attributes and then rendered without sanitization, leading to cross‑site scripting vulnerabilities.

Affected Systems

Versions of the Symfony Framework from 6.1.0 through 6.4.41, as well as the 7.4.13 and 8.0.13 releases of Symfony, and the symfony/html-sanitizer component in those same releases are affected. The issue was fixed in releases 6.4.41, 7.4.13, and 8.0.13 and any newer Symfony releases.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is unlikely to be widespread at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker can embed malicious URLs in user‑supplied HTML content that bypasses sanitization, potentially executing unauthorized scripts in the victim’s browser.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

symfony

affected

Version	Status	Constraints
`>= 6.1.0, < 6.4.41`	affected	—
`>= 7.0.0-BETA1, < 7.4.13`	affected	—
`>= 8.0.0-BETA1, < 8.0.13`	affected	—

symfony

html-sanitizer

affected

Version	Status	Constraints
`>= 6.1.0, < 6.4.41`	affected	—
`>= 7.0.0-BETA1, < 7.4.13`	affected	—
`>= 8.0.0-BETA1, < 8.0.13`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:sensiolabs:symfony::::::::
	cpe:2.3:a:sensiolabs:symfony::::::::
	cpe:2.3:a:sensiolabs:symfony::::::::

No data.

Vendor Product Versions

Symfony

Html-sanitizer

Version	Status	Scheme	Platform
`[6.1.0,6.4.41)`	affected	semver	—
`[7.0.0-BETA1,7.4.13)`	affected	semver	—
`[8.0.0-BETA1,8.0.13)`	affected	semver	—

Symfony

Version	Status	Scheme	Platform
`[6.1.0,6.4.41)`	affected	semver	—
`[7.0.0-BETA1,7.4.13)`	affected	semver	—
`[8.0.0-BETA1,8.0.13)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Symfony Framework and symfony/html-sanitizer to the fixed releases 6.4.41, 7.4.13, 8.0.13 or later.
Strip or block <object>, <applet>, <iframe>, <img> elements and <meta http-equiv='refresh'> tags or configure UrlAttributeSanitizer to exclude them, addressing the HTML injection weakness (CWE-1023).
Validate all user‑supplied URLs against a whitelist of safe schemes and reject JavaScript: and other unsafe protocols, mitigating Cross‑Site Scripting (CWE-79).

Generated by OpenCVE AI on August 3, 2026 at 03:16 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6312-1	symfony security update
Github GHSA	GHSA-x5qj-865h-mgvm	Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.264% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/symfony/symfony/commit/069a70f9f26e61e9de3b7f9a864a86ed24b36bd0
https://github.com/symfony/symfony/releases/tag/v6.4.41
https://github.com/symfony/symfony/releases/tag/v7.4.13
https://github.com/symfony/symfony/releases/tag/v8.0.13
https://github.com/symfony/symfony/security/advisories/GHSA-x5qj-865h-mgvm

History

Aug 3, 2026 4:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Symfony Symfony html-sanitizer Symfony symfony
Vendors & Products		Symfony Symfony html-sanitizer Symfony symfony

Jul 21, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 7:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.
Title		Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content
Weaknesses		CWE-1023 CWE-79
References		https://github.com/symfony/symfony/commit/069a70f9f26e61e9de3b7f9a864a86ed24b36bd0 https://github.com/symfony/symfony/releases/tag/v6.4.41 https://github.com/symfony/symfony/releases/tag/v7.4.13 https://github.com/symfony/symfony/releases/tag/v8.0.13 https://github.com/symfony/symfony/security/advisories/GHSA-x5qj-865h-mgvm
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`