PT-2026-44134 · Symfony · Symfony

Published 2026-05-21 · Updated 2026-05-27 · CVE-2026-45065

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.25

Description The UrlGenerator class, used by Twig path() and url() helpers, fails to properly anchor regular expressions when validating path parameters that use alternations. The validation pattern is constructed as '#^'.$req.'$#', which causes the ^ and $ anchors to apply only to the first and last alternatives. This allows values containing any of the middle alternatives to be accepted as valid. For example, a value like /evil.com could satisfy a requirement containing vi, resulting in the generation of a protocol-relative URL that redirects the browser to an external site.

Recommendations Update to version 5.4.25 or later.

Exploit

Open Redirect

Weakness Enumeration

CWE-185

CWE-601

Related Identifiers

CVE-2026-45065

GHSA-72XP-P242-47P9

Affected Products

Symfony

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45065.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/routing/CVE-2026-45065.yaml · Exploit
• https://cve.org/CVERecord?id=CVE-2026-45065 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-45065 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45065 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45065 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45065 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-72xp-p242-47p9 · Vendor Advisory
• https://github.com/symfony/symfony/security/advisories/GHSA-72xp-p242-47p9 · Note
• https://github.com/symfony/symfony/commit/bcf487c22f3240ba994124e0e0fe8616f3cfc47a · Note
• https://github.com/symfony/symfony · Note
• https://symfony.com/blog/cve-2026-45065-urlgenerator-route-requirement-bypass-via-unanchored-regex-alternation-off-site-host-url-injection · Note
• https://symfony.com/cve-2026-45065 · Note