CVE-2026-48784

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

View on CVE.org

Published Jul 14, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters to generate URLs that collapse to a different path under RFC 3986 normalization. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

Analysis

Technical impact

Symfony’s UrlGenerator::doGenerate() performs dot‑segment encoding with an incorrect strtr() routine that skips every other chained '../' or './' segment. As a result, attacker‑controlled route parameters can generate URLs that, after RFC 3986 normalization, collapse to a path that differs from the intended one. This flaw is associated with CWE‑172 (Relative Path Traversal) and CWE‑601 (URL Redirection to Untrusted Site). It does not provide arbitrary code execution.

Affected Systems

Symfony’s Routing component and the core framework are affected. Vulnerable versions are prior to 5.4.53 for Symfony 5, prior to 6.4.41 for Symfony 6, prior to 7.4.13 for Symfony 7, and prior to 8.0.13 for Symfony 8. All earlier releases before those patch versions remain vulnerable.

Risk and Exploitability

The CVSS score of 5.1 positions this vulnerability in the medium severity range. The EPSS score of less than 1% suggests a low probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could exploit the flaw by crafting a URL that includes repeated dot‑segments such that UrlGenerator produces a path that resolves to an unintended resource. The likely attack vector is remote via HTTP requests.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

symfony

affected

Version	Status	Constraints
`< 5.4.53`	affected	—
`>= 6.0.0-BETA1, < 6.4.41`	affected	—
`>= 7.0.0-BETA1, < 7.4.13`	affected	—
`>= 8.0.0-BETA1, < 8.0.13`	affected	—

symfony

routing

affected

Version	Status	Constraints
`< 5.4.53`	affected	—
`>= 6.0.0-BETA1, < 6.4.41`	affected	—
`>= 7.0.0-BETA1, < 7.4.13`	affected	—
`>= 8.0.0-BETA1, < 8.0.13`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:sensiolabs:symfony::::::::
	cpe:2.3:a:sensiolabs:symfony::::::::
	cpe:2.3:a:sensiolabs:symfony::::::::
	cpe:2.3:a:sensiolabs:symfony::::::::

No data.

Vendor Product Versions

Symfony

Routing

Version	Status	Scheme	Platform
`[0,5.4.53)`	affected	semver	—
`[6.0.0-BETA1,6.4.41)`	affected	semver	—
`[7.0.0-BETA1,7.4.13)`	affected	semver	—
`[8.0.0-BETA1,8.0.13)`	affected	semver	—

Symfony

Version	Status	Scheme	Platform
`[0,5.4.53)`	affected	semver	—
`[6.0.0-BETA1,6.4.41)`	affected	semver	—
`[7.0.0-BETA1,7.4.13)`	affected	semver	—
`[8.0.0-BETA1,8.0.13)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Symfony and the Routing component to the fixed releases 5.4.53, 6.4.41, 7.4.13, or 8.0.13.
Validate or sanitize route parameters before passing them to UrlGenerator, stripping or rejecting any sequences that could form chained "../" or "./" segments.
Configure strict host and path checks on redirects or generated URLs to prevent navigation to unintended internal or external resources.

Generated by OpenCVE AI on August 1, 2026 at 09:21 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6312-1	symfony security update
Debian DSA	DSA-6317-1	symfony security update
Github GHSA	GHSA-h5x3-xfc9-m39h	Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.348% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/symfony/symfony/commit/4b63c3a3f7af04ecd79c89a594b0b02a01990b1d
https://github.com/symfony/symfony/releases/tag/v5.4.53
https://github.com/symfony/symfony/releases/tag/v6.4.41
https://github.com/symfony/symfony/releases/tag/v7.4.13
https://github.com/symfony/symfony/security/advisories/GHSA-h5x3-xfc9-m39h

History

Aug 5, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Symfony Symfony routing Symfony symfony
Vendors & Products		Symfony Symfony routing Symfony symfony

Jul 15, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 7:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters to generate URLs that collapse to a different path under RFC 3986 normalization. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
Title		Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
Weaknesses		CWE-172 CWE-601
References		https://github.com/symfony/symfony/commit/4b63c3a3f7af04ecd79c89a594b0b02a01990b1d https://github.com/symfony/symfony/releases/tag/v5.4.53 https://github.com/symfony/symfony/releases/tag/v6.4.41 https://github.com/symfony/symfony/releases/tag/v7.4.13 https://github.com/symfony/symfony/security/advisories/GHSA-h5x3-xfc9-m39h
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`