Server-side request forgery (SSRF) In symfony
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters to generate URLs that collapse to a different path under RFC 3986 normalization. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 packagist | >=0 <5.4.53 || >=6.0.0 <6.4.41 || >=7.0.0 <7.4.13 || >=8.0.0 <8.0.13 | 5.4.53, 6.4.41, 7.4.13, 8.0.13 | |
packagist | >=0 <5.4.53 || >=6.0.0 <6.4.41 || >=7.0.0 <7.4.13 || >=8.0.0 <8.0.13 | 5.4.53, 6.4.41, 7.4.13, 8.0.13 | |
 debian 13 | =6.4.21+dfsg-2 || =6.4.21+dfsg-2+deb13u1 || =6.4.24+dfsg-1 || =6.4.25+dfsg-1 || =6.4.40+dfsg-0+deb13u1 || >=0 <6.4.41+dfsg-0+deb13u1 | 6.4.41+dfsg-0+deb13u1 | |
debian 11 | =4.4.19+dfsg-2 || =4.4.19+dfsg-2+deb11u1 || =4.4.19+dfsg-2+deb11u2 || =4.4.19+dfsg-2+deb11u3 || =4.4.19+dfsg-2+deb11u4 || =4.4.19+dfsg-2+deb11u5 || =4.4.19+dfsg-2+deb11u6 || =4.4.19+dfsg-2+deb11u7 || =4.4.19+dfsg-3 || =5.0.0~beta2-1 || =5.0.2-1 || =5.0.4-1 || =5.2.1+dfsg-1 || =5.2.2+dfsg-1 || =5.2.3+dfsg-1 || =5.2.4+dfsg-1 || =5.2.5+dfsg-1 || =5.2.6+dfsg-1 || =5.3.10+dfsg-1 || =5.3.12+dfsg-1 || =5.3.12+dfsg-2 || =5.3.9+dfsg-1 || =5.4.0+dfsg-1 || =5.4.0+dfsg-2 || =5.4.0~beta1+dfsg-1 || =5.4.0~beta2+dfsg-1 || =5.4.0~beta3+dfsg-1 || =5.4.0~rc1+dfsg-1 || =5.4.0~rc1+dfsg-2 || =5.4.0~rc1+dfsg-3 || =5.4.1+dfsg-1 || =5.4.10+dfsg-1 || =5.4.11+dfsg-1 || =5.4.11+dfsg-2 || =5.4.12+dfsg-1 || =5.4.12+dfsg-2 || =5.4.13+dfsg-1 || =5.4.14+dfsg-1 || =5.4.15+dfsg-1 || =5.4.16+dfsg-1 || =5.4.18+dfsg-1 || =5.4.18+dfsg-2 || =5.4.18+dfsg-3 || =5.4.19+dfsg-1 || =5.4.2+dfsg-1 || =5.4.2+dfsg-2 || =5.4.2+dfsg-3 || =5.4.20+dfsg-1 || =5.4.21+dfsg-1 || =5.4.22+dfsg-1 || =5.4.22+dfsg-2 || =5.4.22+dfsg-3 || =5.4.23+dfsg-1 || =5.4.24+dfsg-1 || =5.4.25+dfsg-1 || =5.4.27+dfsg-1 || =5.4.28+dfsg-1 || =5.4.29+dfsg-1 || =5.4.30+dfsg-1 || =5.4.31+dfsg-1 || =5.4.31+dfsg-2 || =5.4.32+dfsg-1 || =5.4.33+dfsg-1 || =5.4.34+dfsg-1 || =5.4.34+dfsg-2 || =5.4.35+dfsg-1 || =5.4.35+dfsg-2 || =5.4.35+dfsg-3 || =5.4.4+dfsg-1 || =5.4.6+dfsg-1 || =5.4.8+dfsg-1 || =5.4.9+dfsg-1 || =5.4.9+dfsg-2 || =6.3.0+dfsg-1 || =6.3.0~rc1+dfsg-1 || =6.3.0~rc2+dfsg-1 || =6.3.1+dfsg-1 || =6.3.3+dfsg-1 || =6.3.4+dfsg-1 || =6.3.5+dfsg-1 || =6.3.6+dfsg-1 || =6.3.7+dfsg-1 || =6.4.0+dfsg-1 || =6.4.0~beta2+dfsg-1 || =6.4.0~beta3+dfsg-1 || =6.4.0~rc1+dfsg-1 || =6.4.0~rc2+dfsg-1 || =6.4.1+dfsg-1 || =6.4.10+dfsg-1 || =6.4.11+dfsg-1 || =6.4.12+dfsg-1 || =6.4.13+dfsg-1 || =6.4.14+dfsg-1 || =6.4.15+dfsg-1 || =6.4.16+dfsg-1 || =6.4.16+dfsg-2 || =6.4.17+dfsg-1 || =6.4.17+dfsg-2 || =6.4.17+dfsg-3 || =6.4.17+dfsg-4 || =6.4.17+dfsg-5 || =6.4.17+dfsg-6 || =6.4.18+dfsg-1 || =6.4.19+dfsg-1 || =6.4.19+dfsg-2 || =6.4.2+dfsg-1 || =6.4.20+dfsg-1 || =6.4.20+dfsg-2 || =6.4.21+dfsg-1 || =6.4.21+dfsg-2 || =6.4.24+dfsg-1 || =6.4.25+dfsg-1 || =6.4.3+dfsg-1 || =6.4.4+dfsg-1 || =6.4.4+dfsg-2 || =6.4.4+dfsg-3 || =6.4.4+dfsg-4 || =6.4.5+dfsg-1 || =6.4.5+dfsg-2 || =6.4.5+dfsg-3 || =6.4.5+dfsg-4 || =6.4.6+dfsg-1 || =6.4.7+dfsg-1 || =6.4.9+dfsg-1 || =7.0.4+dfsg-1 || =7.0.5+dfsg-1 || =7.0.6+dfsg-1 || =7.0.7+dfsg-1 || =7.1.0~beta1+dfsg-1 || =7.1.0~rc1+dfsg-1 || =7.1.2+dfsg-1 || =7.1.3+dfsg-1 || =7.1.4+dfsg-1 || =7.1.5+dfsg-1 || =7.2.0~beta1+dfsg-1 || =7.2.0~beta2+dfsg-1 || =7.2.0~rc1+dfsg-1 || =7.2.1+dfsg-1 || =7.2.2+dfsg-1 || =7.2.3+dfsg-1 || =7.2.4+dfsg-1 || =7.2.5+dfsg-1 || =7.2.6-1 || =7.3.0+dfsg-1 || =7.3.0~beta1+dfsg-1 || =7.3.0~beta2+dfsg-1 || =7.3.0~rc1+dfsg-1 || =7.3.1+dfsg-1 || =7.3.2+dfsg-1 || =7.3.3+dfsg-1 || =7.3.4+dfsg-1 || =7.3.5-1 || =7.4.0+dfsg-1 || =7.4.0+dfsg-2 || =7.4.0~beta1-1 || =7.4.0~beta1-2 || =7.4.0~beta2+dfsg-1 || =7.4.0~beta2+dfsg-2 || =7.4.0~beta2+dfsg-3 || =7.4.0~rc1+dfsg-1 || =7.4.0~rc2+dfsg-1 || =7.4.0~rc3+dfsg-1 || =7.4.10+dfsg-1 || =7.4.12+dfsg-1 || =7.4.13+dfsg-1 || =7.4.13+dfsg-2 || =7.4.14+dfsg-1 || =7.4.15+dfsg-1 || =7.4.15+dfsg-2 || =7.4.16+dfsg-1 || =7.4.17+dfsg-1 || =7.4.2+dfsg-1 || =7.4.2+dfsg-2 || =7.4.3+dfsg-1 || =7.4.4+dfsg-1 || =7.4.5+dfsg-1 || =7.4.6+dfsg-1 || =7.4.6+dfsg-2 || =7.4.7+dfsg-1 || =7.4.8+dfsg-1 || =7.4.9+dfsg-1 || =8.0.0+dfsg-1 || =8.0.0~beta2+dfsg-1 || =8.0.0~beta2+dfsg-2 || =8.0.0~rc1+dfsg-1 || =8.0.0~rc2+dfsg-1 || =8.0.0~rc3+dfsg-1 || =8.0.10-1 || =8.0.11+dfsg-1 || =8.0.12+dfsg-1 || =8.0.13+dfsg-1 || =8.0.2+dfsg-1 || =8.0.3+dfsg-1 || =8.0.4+dfsg-1 || =8.0.5+dfsg-1 || =8.0.6+dfsg-1 || =8.0.7+dfsg-1 || =8.0.8+dfsg-1 || =8.0.9+dfsg-1 || =8.1.0+dfsg-1 || =8.1.1+dfsg-1 || =8.1.3+dfsg-1 || =8.1.4+dfsg-1 || =8.1.5+dfsg-1 | - | |
debian 12 | =5.4.23+dfsg-1 || =5.4.23+dfsg-1+deb12u1 || =5.4.23+dfsg-1+deb12u2 || =5.4.23+dfsg-1+deb12u3 || =5.4.23+dfsg-1+deb12u4 || =5.4.23+dfsg-1+deb12u5 || =5.4.24+dfsg-1 || =5.4.25+dfsg-1 || =5.4.27+dfsg-1 || =5.4.28+dfsg-1 || =5.4.29+dfsg-1 || =5.4.30+dfsg-1 || =5.4.31+dfsg-1 || =5.4.31+dfsg-2 || =5.4.32+dfsg-1 || =5.4.33+dfsg-1 || =5.4.34+dfsg-1 || =5.4.34+dfsg-2 || =5.4.35+dfsg-1 || =5.4.35+dfsg-2 || =5.4.35+dfsg-3 || =5.4.52+dfsg-0+deb12u1 || >=0 <5.4.53+dfsg-0+deb12u1 | 5.4.53+dfsg-0+deb12u1 | |
debian 14 | =6.4.21+dfsg-2 || =6.4.24+dfsg-1 || =6.4.25+dfsg-1 || =7.0.4+dfsg-1 || =7.0.5+dfsg-1 || =7.0.6+dfsg-1 || =7.0.7+dfsg-1 || =7.1.0~beta1+dfsg-1 || =7.1.0~rc1+dfsg-1 || =7.1.2+dfsg-1 || =7.1.3+dfsg-1 || =7.1.4+dfsg-1 || =7.1.5+dfsg-1 || =7.2.0~beta1+dfsg-1 || =7.2.0~beta2+dfsg-1 || =7.2.0~rc1+dfsg-1 || =7.2.1+dfsg-1 || =7.2.2+dfsg-1 || =7.2.3+dfsg-1 || =7.2.4+dfsg-1 || =7.2.5+dfsg-1 || =7.2.6-1 || =7.3.0+dfsg-1 || =7.3.0~beta1+dfsg-1 || =7.3.0~beta2+dfsg-1 || =7.3.0~rc1+dfsg-1 || =7.3.1+dfsg-1 || =7.3.2+dfsg-1 || =7.3.3+dfsg-1 || =7.3.4+dfsg-1 || =7.3.5-1 || =7.4.0+dfsg-1 || =7.4.0+dfsg-2 || =7.4.0~beta1-1 || =7.4.0~beta1-2 || =7.4.0~beta2+dfsg-1 || =7.4.0~beta2+dfsg-2 || =7.4.0~beta2+dfsg-3 || =7.4.0~rc1+dfsg-1 || =7.4.0~rc2+dfsg-1 || =7.4.0~rc3+dfsg-1 || =7.4.10+dfsg-1 || =7.4.12+dfsg-1 || =7.4.2+dfsg-1 || =7.4.2+dfsg-2 || =7.4.3+dfsg-1 || =7.4.4+dfsg-1 || =7.4.5+dfsg-1 || =7.4.6+dfsg-1 || =7.4.6+dfsg-2 || =7.4.7+dfsg-1 || =7.4.8+dfsg-1 || =7.4.9+dfsg-1 || >=0 <7.4.13+dfsg-1 | 7.4.13+dfsg-1 |
Aliases
References
1. https://github.com/symfony/symfony/security/advisories/GHSA-h5x3-xfc9-m39h2. https://github.com/symfony/symfony/commit/4b63c3a3f7af04ecd79c89a594b0b02a01990b1d3. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/routing/CVE-2026-48784.yaml4. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48784.yaml5. https://symfony.com/cve-2026-48784
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.