CVE-2026-48784

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.48 Symfony versions prior to 6.4.15 Symfony versions prior to 7.4.0 Symfony versions prior to 8.0.0 Symfony versions prior to 8.1.0

Description The doGenerate() function in SymfonyComponentRoutingGeneratorUrlGenerator incorrectly percent-encodes dot-segments. When using strtr to encode /../ and /./, the function advances past the trailing slash of each match, leaving subsequent dot-segments in a chained sequence unescaped. If a route uses a permissive requirement (such as .+ or .*) for a parameter, attacker-controlled chained .. or . segments can result in a generated URL that collapses to a different path during strict RFC 3986 normalization. This affects the Twig path() and url() helpers, as well as any server-side use of UrlGenerator.

Recommendations Update to version 5.4.48 or newer. Update to version 6.4.15 or newer. Update to version 7.4.0 or newer. Update to version 8.0.0 or newer. Update to version 8.1.0 or newer.