CVE-2026-48736

Katalog CVE

CVSS 8.6 · High EPSS 0,57%

Kerentanan Incomplete List of Disallowed Inputs pada sensiolabs symfony. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

16 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-184: Incomplete List of Disallowed Inputs
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/symfony/security/advisories/GHSA-38cx-cq6f-5755 patch · advisory vendor
• https://github.com/symfony/symfony/commit/82765368cf74177c36613575182f168a2eb765b2 patch
• https://github.com/symfony/symfony/commit/85b831555be8ea1f43bf01078afe87bc4c92f65e patch
• https://github.com/symfony/symfony/releases/tag/v5.4.53 release notes
• https://github.com/symfony/symfony/releases/tag/v6.4.41 release notes
• https://github.com/symfony/symfony/releases/tag/v7.4.13 release notes