CVE-2026-45755: sensiolabs symfony

csirt@kutim:~/threat-intel/cve/CVE-2026-45755

CVSS 5.3 · Medium EPSS 0,27%

Kerentanan Missing Authentication for Critical Function pada sensiolabs symfony. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse() received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged Mailtrap delivery, bounce, open, click, or spam events. This issue is fixed in versions 7.4.12 and 8.0.12.

Rincian

Terbit di NVD: 14 Juli 2026
Terakhir diubah: 15 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-306: Missing Authentication for Critical Function
CWE-347: Improper Verification of Cryptographic Signature
EPSS (30 hari): 0,27% peluang dieksploitasi; lebih tinggi dari 17,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
sensiolabs	symfony	Versi 7.2.0 hingga sebelum 7.4.12
sensiolabs	symfony	Versi 8.0.0 hingga sebelum 8.0.12

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/symfony/symfony/security/advisories/GHSA-59f3-vp2f-mp9w patch · advisory vendor
https://github.com/symfony/symfony/commit/4e0467e4e182cf2e704a3d9e1bc1a6be65d52ab8 patch
https://github.com/symfony/symfony/releases/tag/v7.4.12 product · release notes
https://github.com/symfony/symfony/releases/tag/v8.0.12 product · release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.