CVE-2026-48784

Katalog CVE

CVSS 6.1 · Medium EPSS 0,35%

Kerentanan Encoding Error pada sensiolabs symfony. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters to generate URLs that collapse to a different path under RFC 3986 normalization. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

15 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-172: Encoding Error
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/symfony/security/advisories/GHSA-h5x3-xfc9-m39h patch · advisory vendor
• https://github.com/symfony/symfony/commit/4b63c3a3f7af04ecd79c89a594b0b02a01990b1d patch
• https://github.com/symfony/symfony/releases/tag/v5.4.53 product · release notes
• https://github.com/symfony/symfony/releases/tag/v6.4.41 product · release notes
• https://github.com/symfony/symfony/releases/tag/v7.4.13 product · release notes