CVE-2026-48760

Katalog CVE

CVSS 6.1 · Medium EPSS 0,34%

Kerentanan User Interface (UI) Misrepresentation of Critical Information pada sensiolabs symfony. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse() rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs to retain visual-spoofing characters that downstream consumers could decode or display. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

15 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-451: User Interface (UI) Misrepresentation of Critical Information
CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/symfony/security/advisories/GHSA-v3wm-qf9p-c549 patch · advisory vendor
• https://github.com/symfony/symfony/commit/b21a626fd90f5c12d2db432c629eed3e780ba2f8 patch
• https://github.com/symfony/symfony/releases/tag/v6.4.41 product · release notes
• https://github.com/symfony/symfony/releases/tag/v7.4.13 product · release notes
• https://github.com/symfony/symfony/releases/tag/v8.0.13 product · release notes