Sign in
Deutsch English Español Polski
Medium

Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

  • Disclosed: 15.06.2026
  • Updated: 11.10.2026 10:22

Description

Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer::parse() rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered href. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (%E2%80%AE for U+202E, %E2%81%A6 for U+2066, etc.) are not matched by the deny regex, survive league/uri's parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare urldecode($href) against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.

The same UrlSanitizer::parse() carries an ASCII-only /\s/ whitespace check (no /u modifier) intended as a backstop against malformed URLs. Without the /u modifier, PCRE's \s matches only ASCII whitespace, so Unicode whitespace characters — NBSP (U+00A0), the zero-width no-break space / BOM (U+FEFF), line/paragraph separators (U+2028, U+2029), ogham space (U+1680), the U+2000–U+200A en/em quad family, narrow / medium / ideographic spaces (U+202F, U+205F, U+3000) and NEL (U+0085) — pass through unchanged in both raw and percent-encoded forms. In hostname positions they enable lookalike spoofs (example<NBSP>.com); in path/query/fragment they enable allow-list drift when a downstream consumer strips whitespace before comparison.

Resolution

UrlSanitizer::parse() now denies BiDi formatting marks together with Unicode whitespace and the zero-width no-break space, in both the raw input and the percent-decoded form of each parsed URL component (user, pass, host, path, query, fragment). ASCII space remains tolerated in path/query/fragment via the existing percent-encoding step.

The patches for this issue are available here for branch 6.4 (and forward-ported to 7.4, 8.0 and 8.1).

Credits

Symfony would like to thank Scott Arciszewski (Trail of Bits) for reporting the issue and Nicolas Grekas for providing the fix.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package symfony/html-sanitizer >= 6.1.0, < 6.4.41, >= 7.0.0, < 7.4.13, >= 8.0.0, < 8.0.13 6.4.41, 7.4.13, 8.0.13
Composer package symfony/symfony >= 6.1.0, < 6.4.41, >= 7.0.0, < 7.4.13, >= 8.0.0, < 8.0.13 6.4.41, 7.4.13, 8.0.13

References

CVSS score -
Weakness (CWE)
CWE-1007, CWE-451
Platform
Composer
Package
symfony/html-sanitizer, symfony/symfony
Disclosed
15.06.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-v3wm-qf9p-c549 - CC BY 4.0

Vulnerability history: symfony/symfony

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (100) in the archive
Total entries
100
First → latest
11.2019 06.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 8
  • High 28
  • Medium 51
  • Low 13

Disclosures per year

Severity:
  1. Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense this entry
    Medium CVE-2026-48760 >= 6.1.0, < 6.4.41, >= 7.0.0, < 7.4.13, >= 8.0.0, < 8.0.13 6.4.41, 7.4.13, 8.0.13
  2. Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
    High CVE-2026-48489 < 5.4.53, >= 6.0.0, < 6.4.41, >= 7.0.0, < 7.4.13, >= 8.0.0, < 8.0.13 5.4.53, 6.4.41, 7.4.13, 8.0.13
  3. Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
    High CVE-2026-45077 < 5.4.52, >= 6.0.0, < 6.4.40, >= 7.0.0, < 7.4.12, >= 8.0.0, < 8.0.12 5.4.52, 6.4.40, 7.4.12, 8.0.12
  4. Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
    High CVE-2026-45075 >= 7.4.0, < 7.4.12, >= 8.0.0, < 8.0.12 7.4.12, 8.0.12
  5. Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
    High CVE-2026-45067 < 5.4.52, >= 6.0.0, < 6.4.40, >= 7.0.0, < 7.4.12, >= 8.0.0, < 8.0.12 5.4.52, 6.4.40, 7.4.12, 8.0.12
  6. Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
    High CVE-2026-45063 < 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12 5.4.52, 6.4.40, 7.4.12, 8.0.12
  7. Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
    High · 7.3 CVE-2025-64500 >= 2.0.0, < 5.4.50, >= 6.0.0, < 6.4.29, >= 7.0.0, < 7.3.7 5.4.50, 6.4.29, 7.3.7
  8. Symfony vulnerable to command execution hijack on Windows with Process class
    High · 8.4 CVE-2024-51736 < 5.4.46, >= 6.0.0, < 6.4.14, >= 7.0.0, < 7.1.7 5.4.46, 6.4.14, 7.1.7
  9. Symfony Cross-Site Request Forgery vulnerability in the Web Profiler
    High · 8.1 CVE-2014-6072 >= 2.0.0, < 2.3.19, >= 2.4.0, < 2.4.9, >= 2.5.0, < 2.5.4 2.3.19, 2.4.9, 2.5.4
  10. Symfony XML Entity Expansion security vulnerability
    High · 7.5 ghsa-q2gc-gg3x-7942 >= 2.0.0, < 2.0.17 2.0.17
  11. Symfony XML decoding attack vector through external entities
    Critical · 9.8 ghsa-mmcv-fvq8-r9x3 >= 2.0.0, < 2.0.11 2.0.11
  12. Symfony allows direct access of ESI URLs behind a trusted proxy
    High · 7.5 CVE-2014-5245 >= 2.0.0, < 2.3.19, >= 2.4.0, < 2.4.9, >= 2.5.0, < 2.5.4 2.3.19, 2.4.9, 2.5.4
  13. Symfony vulnerable to denial of service via a malicious HTTP Host header
    High · 7.5 CVE-2014-5244 >= 2.0.0, < 2.3.19, >= 2.4.0, < 2.4.9, >= 2.5.0, < 2.5.4 2.3.19, 2.4.9, 2.5.4
  14. Code injection in the way Symfony implements translation caching in FrameworkBundle
    High · 7.5 CVE-2014-4931 >= 2.0.0, < 2.3.19, >= 2.4.0, < 2.4.9, >= 2.5.0, < 2.5.4 2.3.19, 2.4.9, 2.5.4
  15. Symfony Incorrect Access Control
    Critical · 9.8 CVE-2017-11365 >= 2.7.30, < 2.7.32, >= 2.8.23, < 2.8.25, >= 3.2.10, < 3.2.12, >= 3.3.3, < 3.3.5 2.7.32, 2.8.25, 3.2.12, 3.3.5
  16. Symphony Denial of Service Via Overlong Usernames
    High · 7.5 CVE-2016-4423 >= 2.3.0, < 2.3.41, >= 2.4.0, < 2.7.13, >= 2.8.0, < 2.8.6, >= 3.0.0, < 3.0.6 2.3.41, 2.7.13, 2.8.6, 3.0.6
  17. Symfony Cryptographic Vulnerability
    High · 7.5 CVE-2016-1902 >= 2.3.0, < 2.3.37, >= 2.4.0, < 2.6.13, >= 2.7.0, < 2.7.9 2.3.37, 2.6.13, 2.7.9
  18. Symfony Vulnerable to Timing Attack
    High CVE-2015-8125 >= 2.3.0, < 2.3.35, >= 2.7.0, < 2.7.7, >= 2.4.0, < 2.6.12 2.3.35, 2.7.7, 2.6.12
  19. Symphony Vulnerable to PHP Code Injection via YAML Parsing
    High CVE-2013-1348 >= 2.0.0, < 2.0.22 2.0.22
  20. Symfony Arbitrary PHP code Execution
    High CVE-2013-1397 >= 2.2.0-BETA1, < 2.2.0-BETA2, >= 2.0.0, < 2.0.22, >= 2.1.0, < 2.1.7 2.2.0-BETA2, 2.0.22, 2.1.7
Show more (17) Showing 20 of 37

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.