CVE-2026-45755
published 2026-07-14CVE-2026-45755: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse()…
PriorityP432medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.24%
15.0th percentile
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse() received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged Mailtrap delivery, bounce, open, click, or spam events. This issue is fixed in versions 7.4.12 and 8.0.12.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sensiolabs | symfony | >= 7.2.0 < 7.4.12 | 7.4.12 |
| sensiolabs | symfony | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | mailtrap-mailer | >= 7.2.0 < 7.4.12 | 7.4.12 |
| symfony | mailtrap-mailer | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | >= 7.2.0 < 7.4.12 | 7.4.12 |
| symfony | symfony | >= 8.0.0 < 8.0.12 | 8.0.12 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
ghsa·2026-05-28
CVE-2026-45755 [MEDIUM] CWE-306 Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
### Description
The Mailtrap mailer bridge ships a webhook request parser used to authenticate and decode the event callbacks Mailtrap POSTs to an application's webhook endpoint. Its `doParse(Request $request, #[\SensitiveParameter] string $secret)` method receives the configured webhook secret but never reads it; it decodes and returns the payload unconditionally, ignoring the `X-Mt-Signature` HMAC header Mailtrap sends with each request.
As a result, an application that wires up the Mailtrap webhook endpoint accepts **any** POST to that URL, even when a signing secret is configured (the recommended setup). An attacker who knows the endpoint exists can submit forged
VulDB
Symfony Mailtrap Mailer Webhook Parser injection
vuldb·2026-05-28
CVE-2026-45755 [CRITICAL] Symfony Mailtrap Mailer Webhook Parser injection
A vulnerability categorized as critical has been discovered in Symfony Mailtrap Mailer. Affected by this issue is some unknown functionality of the component Webhook Parser. The manipulation results in injection.
This vulnerability is identified as CVE-2026-45755. The attack can be executed remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-14
Published