CVE-2026-45753
published 2026-07-14CVE-2026-45753: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12…
PriorityP432medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.30%
21.8th percentile
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes() omits URL-valued attributes including action, formaction, poster, and cite, so configurations that admit those attributes can leave javascript: URIs unsanitized and enable XSS when the resulting HTML is rendered or a victim submits a form or clicks a button. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sensiolabs | symfony | >= 6.1.0 < 6.4.40 | 6.4.40 |
| sensiolabs | symfony | >= 7.0.0 < 7.4.12 | 7.4.12 |
| sensiolabs | symfony | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | html-sanitizer | — | — |
| symfony | html-sanitizer | — | — |
| symfony | html-sanitizer | — | — |
| symfony | html-sanitizer | >= 6.1.0 < 6.4.40 | 6.4.40 |
| symfony | html-sanitizer | >= 7.0.0 < 7.4.12 | 7.4.12 |
| symfony | html-sanitizer | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | >= 6.1.0 < 6.4.40 | 6.4.40 |
| symfony | symfony | >= 7.0.0 < 7.4.12 | 7.4.12 |
| symfony | symfony | >= 8.0.0 < 8.0.12 | 8.0.12 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)
ghsa·2026-05-28
CVE-2026-45753 [LOW] CWE-79 Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)
Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)
### Description
`symfony/html-sanitizer` lets applications sanitise untrusted HTML. `UrlAttributeSanitizer` is the visitor responsible for validating URL-valued attributes and stripping dangerous schemes from them; it runs on every element regardless of configuration. Whether an attribute is *kept* is decided by the element/attribute allow-list; validating the *scheme* of a URL attribute is solely `UrlAttributeSanitizer`'s responsibility.
`UrlAttributeSanitizer::getSupportedAttributes()` returned only `['src', 'href', 'lowsrc', 'background', 'ping']`. The HTML URL-valued attributes `action` (``), `formaction` (``, ``), `poster` (``) and `cite` (``, ``, ``, ``
VulDB
Symfony HtmlSanitizer cross site scripting
vuldb·2026-05-28
CVE-2026-45753 [LOW] Symfony HtmlSanitizer cross site scripting
A vulnerability was found in Symfony HtmlSanitizer. It has been rated as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting.
This vulnerability is referenced as CVE-2026-45753. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/symfony/symfony/commit/487728e7e180a674a6d4c01bd0cb56161cc441b7https://github.com/symfony/symfony/releases/tag/v6.4.40https://github.com/symfony/symfony/releases/tag/v7.4.12https://github.com/symfony/symfony/releases/tag/v8.0.12https://github.com/symfony/symfony/security/advisories/GHSA-hhg7-c65m-h7ff
2026-07-14
Published