CVE-2026-118516

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.56 Symfony versions 6.x prior to 6.4.50 Symfony versions 7.x prior to 7.4.23 Symfony versions 8.x prior to 8.1.11

Description In the Symfony Routing components, CompiledUrlMatcher and UrlMatcher interpret host and path information differently. For routes defining a host, CompiledUrlMatcher matches the combined string of $host, ., and $pathinfo against the host and path regular expressions, whereas UrlMatcher processes them separately. This discrepancy allows a host placeholder to match a / character and consume the start of the path, routing the request to a controller that UrlMatcher would not find. Consequently, path-based authorization rules, such as access control entries and firewall patterns, are evaluated against the actual request path and may not apply, potentially allowing unauthenticated requests to reach protected controllers. This issue affects applications using routes with host placeholders protected by path-based rules.

Recommendations Update to version 5.4.56 or later. Update to version 6.4.50 or later. Update to version 7.4.23 or later. Update to version 8.1.11 or later.