CVE-2026-118517

The Symfony HtmlSanitizer component UrlSanitizer parses URLs differently from browsers, allowing the allowLinkHosts and allowMediaHosts checks to be bypassed for URLs without a well-formed authority, resulting in untrusted hosts being referenced in sanitized output in Symfony versions 6.1.x prior...

EUVD-2026-117579

The Symfony HtmlSanitizer component UrlSanitizer parses URLs differently from browsers, allowing the allowLinkHosts and allowMediaHosts checks to be bypassed for URLs without a well-formed authority, resulting in untrusted hosts being referenced in sanitized output in Symfony versions 6.1.x prior...

CVE-2026-118517

The Symfony HtmlSanitizer component's UrlSanitizer is vulnerable to a bypass in allowLinkHosts() and allowMediaHosts() checks. The issue stems from an interpretation conflict where UrlSanitizer follows RFC 3986 via league/uri, while browsers follow the WHATWG URL standard. Specifically, URLs with...

CVE-2026-118517 Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)

The Symfony HtmlSanitizer component UrlSanitizer parses URLs differently from browsers, allowing the allowLinkHosts and allowMediaHosts checks to be bypassed for URLs without a well-formed authority, resulting in untrusted hosts being referenced in sanitized output in Symfony versions 6.1.x prior...