GHSA-V3WM-QF9P-C549 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

🗓️ 15 Jun 2026 17:32:59Reported by GoogleType

osv

osv🔗 osv.dev👁 8 Views

Symfony HtmlSanitizer denies Bidirectional formatting marks and Unicode whitespace in URLs.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2026-48760	27 May 202610:04	–	circl
CVE	CVE-2026-48760	27 May 202610:04	–	cve
Debian	[SECURITY] [DSA 6312-1] symfony security update	31 May 202612:26	–	debian
Debian CVE	CVE-2026-48760	27 May 202610:04	–	debiancve
Tenable Nessus	Debian dsa-6312 : php-symfony - security update	1 Jun 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-48760	28 May 202600:00	–	nessus
Friends Of PHP	CVE-2026-48760: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense	1 Jan 197000:00	–	friendsofphp
Friends Of PHP	CVE-2026-48760: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense	1 Jan 197000:00	–	friendsofphp
Github Security Blog	Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense	15 Jun 202617:32	–	github
OSV	DEBIAN-CVE-2026-48760	27 May 202619:48	–	osv

Source	Link
github	www.github.com/symfony/symfony/security/advisories/GHSA-v3wm-qf9p-c549
github	www.github.com/symfony/symfony/commit/b21a626fd90f5c12d2db432c629eed3e780ba2f8
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/html-sanitizer/CVE-2026-48760.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48760.yaml
github	www.github.com/symfony/symfony
symfony	www.symfony.com/cve-2026-48760

15 Jun 2026 17:45Current

5.4Medium risk

Vulners AI Score5.4

EPSS0.00025

Bidirectional formatting marks Unicode whitespace No-break space Sanitizer parse