CVE-2026-48760

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 6.4 Symfony versions prior to 7.4 Symfony versions prior to 8.0 Symfony versions prior to 8.1

Description The UrlSanitizer::parse() function fails to properly reject certain characters, allowing for visual spoofing of rendered links. The defense against BiDi (Bidirectional) formatting characters—which are used to change the direction of text—only covers raw UTF-8 forms, meaning percent-encoded versions of these characters are not matched and are re-emitted in the sanitized URL. This can mislead downstream consumers that decode the link before display. Additionally, the whitespace check in UrlSanitizer::parse() only identifies ASCII whitespace. Consequently, Unicode whitespace characters, such as NBSP (U+00A0) or the zero-width no-break space (U+FEFF), pass through unchanged. In hostname positions, this enables lookalike spoofs, and in other positions, it can cause allow-list drift when downstream consumers strip whitespace before comparison.

Recommendations Update to version 6.4 or later. Update to version 7.4 or later. Update to version 8.0 or later. Update to version 8.1 or later.