CVE-2026-45066 Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

What is CVE-2026-45066?

CVE-2026-45066 is a low-severity vulnerability in Sensiolabs Symfony, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts() or allowMediaHosts() because UrlSanitizer::parse() follows RFC 3986 while browsers follow WHATWG URL parsing, and because <area href> is checked against the media policy rather than the link policy. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

Weakness: CWE-436, CWE-184

Which versions are affected by CVE-2026-45066?

12 open source packages ship an affected version, including symfony/html-sanitizer and symfony/symfony. It affects 1 product.

Products include Sensiolabs Symfony.

How do I fix CVE-2026-45066?

Upgrade symfony/html-sanitizer to a fixed version for your release line: 6.4.40, 7.4.12 or 8.0.12.

Is CVE-2026-45066 being exploited?

There is no known exploitation of CVE-2026-45066 in the wild and no public exploit code.

Other vulnerabilities in Sensiolabs Symfony

• CVE-2019-11325 Improper Input Validation in Symfony Critical 9.8
• CVE-2017-11365 Symfony Incorrect Access Control Critical 9.8
• CVE-2019-10913 Invalid HTTP method overrides allow possible XSS or other attacks in Symfony Critical 9.8
• CVE-2018-11407 Symfony Authentication Bypass Critical 9.8
• CVE-2016-2403 Symfony Authentication Bypass Critical 9.8

All Sensiolabs Symfony vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-45066, GHSA-qc95-4862-92fh, UBUNTU-CVE-2026-45066.