PT-2026-44135 · Symfony · Sanitize-Html

Published 2026-05-21 · Updated 2026-05-27 · CVE-2026-45066

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions symfony/html-sanitizer versions prior to 5.4

Description Three bypasses allow content authors to smuggle URLs that are not on the allowlist past sanitization checks. The first bypass occurs because UrlSanitizer::parse() follows RFC-3986, whereas browsers follow the WHATWG URL Standard, which normalizes backslashes (``) to forward slashes (/) before parsing the authority of special schemes. This allows an input like https://[e-mail]/ to be parsed as trusted.com on the server but navigate to https://evil/ in the browser. The second bypass involves the WHATWG standard collapsing multiple forward slashes after a scheme into //, while RFC-3986 does not; consequently, inputs like https:/evil.com/ or https:///evil.com/ are parsed as host-less, skipping the host allowlist, but resolve to evil.com in the browser. The third bypass exists in UrlAttributeSanitizer, which only applies the link policy to <a> elements. Since <area> elements are also navigable hyperlinks, they were incorrectly sanitized against the media policy, bypassing allowLinkHosts() and allowLinkSchemes() entirely.

Recommendations Update to version 5.4 or later.

Exploit

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

CWE-436

Related Identifiers

CVE-2026-45066

GHSA-QC95-4862-92FH

Affected Products

Sanitize-Html

References · 12

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/html-sanitizer/CVE-2026-45066.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45066.yaml · Exploit
• https://ubuntu.com/security/CVE-2026-45066 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45066 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-45066 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45066 · Security Note
• https://osv.dev/vulnerability/GHSA-qc95-4862-92fh · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45066 · Vendor Advisory
• https://github.com/symfony/symfony · Note
• https://github.com/symfony/symfony/security/advisories/GHSA-qc95-4862-92fh · Note
• https://symfony.com/cve-2026-45066 · Note
• https://symfony.com/blog/cve-2026-45066-htmlsanitizer-allowlinkhosts-allowmediahosts-bypass-via-url-parser-differentials-and-area-misclassification · Note