CVE-2026-118517

Name of the Vulnerable Software and Affected Versions Symfony versions 6.1.x through 6.4.49 Symfony versions 7.x through 7.4.22 Symfony versions 8.x through 8.1.10

Description The Symfony HtmlSanitizer component UrlSanitizer parses URLs using the RFC 3986 standard via league/uri, which differs from the WHATWG URL standard used by browsers. This discrepancy allows the allowLinkHosts() and allowMediaHosts() checks to be bypassed when URLs lack a well-formed authority (e.g., http:evil.example, ///evil.example, or https://://evil.example/). In such cases, the sanitizer fails to identify a host, while browsers resolve them to the intended host, leading to untrusted hosts being included in the sanitized output. This issue is exploitable when a host allow-list is used in conjunction with allowRelativeLinks(true) or allowRelativeMedias(true).

Recommendations Update Symfony versions 6.1.x to 6.4.50. Update Symfony versions 7.x to 7.4.23. Update Symfony versions 8.x to 8.1.11.