PT-2026-44133 · Symfony · Symfony

Published 2026-05-21 · Updated 2026-05-27 · CVE-2026-45064

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.31

Description The parse() function in SymfonyComponentHtmlSanitizerTextSanitizerUrlSanitizer (utilized by UrlSanitizer::sanitize() and any HtmlSanitizer configuration permitting links or media) fails to filter Unicode explicit-direction BiDi formatting characters (U+202A–U+202E and U+2066–U+2069). These characters are passed unchanged into href and src attributes. When rendered in a browser, these characters can alter the visual ordering of the URL text, allowing the displayed link to differ from the actual destination, which enables visual spoofing and phishing attacks.

Recommendations Update to version 5.4.31 or later. As a temporary workaround, restrict the use of the parse() function or the HtmlSanitizer configurations that allow links and media until the update is applied.

Exploit

Fix

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

CWE-1007

Related Identifiers

CVE-2026-45064

GHSA-H5VQ-QFCG-4M6P

Affected Products

Symfony

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/html-sanitizer/CVE-2026-45064.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45064.yaml · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-45064 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45064 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45064 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h5vq-qfcg-4m6p · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45064 · Security Note
• https://ubuntu.com/security/CVE-2026-45064 · Vendor Advisory
• https://github.com/symfony/symfony/commit/743a435e948b897ef2b5564ac438d4beb95d2526 · Note
• https://github.com/symfony/symfony · Note
• https://github.com/symfony/symfony/security/advisories/GHSA-h5vq-qfcg-4m6p · Note
• https://symfony.com/cve-2026-45064 · Note
• https://symfony.com/blog/cve-2026-45064-htmlsanitizer-url-attributes-pass-through-bidi-override-characters-visual-href-spoofing · Note