CVE-2026-45064
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse() passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized content to display a link destination that visually differs from the actual destination and enabling phishing-style visual spoofing. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Scoring
- Severity
- LOW
- CVSS base score
- 2.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- EPSS probability
- 0.34%
- CWE
- CWE-451, CWE-1007
- Published
- 2026-07-14
- Last modified
- 2026-07-21
Affected products
- symfony symfony
- symfony symfony
- symfony symfony
- symfony html-sanitizer
- symfony html-sanitizer
- symfony html-sanitizer
Weakness type
Related vulnerabilities
- CVE-2026-87583 — UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a...
- CVE-2026-87624 — UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a...
- CVE-2026-87597 — UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0.8010.36 allowed a...
- CVE-2026-87653 — UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a...
- CVE-2026-87635 — UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...
- CVE-2026-87484 — UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...
- CVE-2026-87458 — UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...
- CVE-2026-87496 — UI misrepresentation in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...