CVE-2026-48760: Symfony Information Disclosure Flaw

CVE-2026-48760 Overview

CVE-2026-48760 affects the Symfony PHP framework, a widely deployed set of reusable components for web and console applications. The vulnerability resides in the UrlSanitizer::parse() method within the HtmlSanitizer component. The sanitizer rejected raw bidirectional (BiDi) formatting characters but failed to reject their percent-encoded equivalents. It also relied on an ASCII-only whitespace check, allowing Unicode whitespace to slip through. Sanitized URLs could retain visual-spoofing characters that downstream consumers decode or render. This weakness is classified as User Interface (UI) Misrepresentation of Critical Information [CWE-451]. Symfony versions 6.1.0 through 6.4.40, 7.4.12, and 8.0.12 are affected.

Critical Impact
Attackers can craft URLs containing percent-encoded BiDi marks or Unicode whitespace to bypass sanitization and deliver visually spoofed links that mislead users into trusting malicious destinations.

Affected Products

Symfony versions 6.1.0 through 6.4.40
Symfony versions 7.0.0 through 7.4.12
Symfony versions 8.0.0 through 8.0.12

Discovery Timeline

2026-07-14 - CVE-2026-48760 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-48760

Vulnerability Analysis

The flaw lives in src/Symfony/Component/HtmlSanitizer/TextSanitizer/UrlSanitizer.php. The parse() routine inspected URL input for a defined set of dangerous characters but only in their raw Unicode form. Percent-encoded representations of the same characters passed through untouched. The sanitizer's whitespace check also operated only against ASCII whitespace, ignoring Unicode whitespace codepoints such as U+00A0 (non-breaking space), U+2028 (line separator), and U+FEFF (zero-width no-break space).

Downstream consumers that decode percent-encoded sequences before rendering or navigation receive a URL that still contains BiDi override marks (U+202A through U+202E, U+2066 through U+2069). These marks flip the visual rendering direction of text, letting an attacker display a URL like example.com while the resolved destination is attacker.com. The EPSS score is 0.262% with a percentile of 17.848, reflecting low observed exploitation activity.

Root Cause

The root cause is incomplete input validation. The denylist enumerated only raw characters and only ASCII whitespace, so equivalent encodings and Unicode-space variants bypassed the check. The fix introduces a comprehensive Unicode-aware regular expression covering both explicit-direction BiDi formatting marks and Unicode whitespace.

Attack Vector

Exploitation requires network delivery of a crafted URL and user interaction to click or otherwise activate the link. The attack succeeds when applications pass user-supplied URLs through Symfony's HtmlSanitizer and then render or forward the sanitized value to a component that decodes percent-encoded characters.

php

 /**
  * Characters with no legitimate place in a URL: explicit-direction BiDi
  * formatting marks plus Unicode whitespace and the zero-width no-break
  * space. ASCII space is tolerated and percent-encoded by parse().
  */
 private const DENIED_CHARS_PATTERN = '/[\t\n\v\f\r\x{0085}\x{00A0}\x{1680}\x{2000}-\x{200A}\x{2028}\x{2029}\x{202F}\x{205F}\x{3000}\x{FEFF}\x{202A}-\x{202E}\x{2066}-\x{2069}]/u';

Source: Symfony Commit b21a626 — the patch adds a Unicode-aware denied-character pattern and applies it after percent-decoding so encoded forms are also rejected.

Detection Methods for CVE-2026-48760

Indicators of Compromise

URLs in application logs containing percent-encoded BiDi sequences such as %E2%80%AA through %E2%80%AE or %E2%81%A6 through %E2%81%A9.
URLs containing Unicode whitespace percent encodings such as %C2%85, %C2%A0, %E2%80%A8, %E2%80%A9, or %EF%BB%BF.
User reports of links whose displayed text does not match the resolved destination host.

Detection Strategies

Scan HTTP request logs and stored user-generated content for the percent-encoded byte sequences listed above using regex-based log queries.
Enumerate deployed Symfony versions across the estate and flag any instance below 6.4.41, 7.4.13, or 8.0.13.
Add static analysis rules to identify code paths that consume UrlSanitizer::parse() output without additional validation.

Monitoring Recommendations

Alert on outbound clicks or redirects to hosts whose punycode-decoded or BiDi-stripped form differs from the displayed label.
Baseline the volume of URLs containing non-ASCII whitespace and investigate deviations.
Correlate suspicious URL rendering with phishing-adjacent telemetry such as newly registered domains and short-lived redirectors.

How to Mitigate CVE-2026-48760

Immediate Actions Required

Upgrade Symfony to 6.4.41, 7.4.13, or 8.0.13 depending on the branch in use.
Audit application code that calls UrlSanitizer::parse() and confirm downstream renderers do not re-decode percent-encoded input without re-validation.
Purge cached or stored user-supplied URLs that contain the flagged percent-encoded sequences.

Patch Information

The fix is delivered in Symfony Release v6.4.41, Symfony Release v7.4.13, and Symfony Release v8.0.13. The upstream commit and advisory are published at GitHub Security Advisory GHSA-v3wm-qf9p-c549.

Workarounds

Apply a pre-sanitization filter that percent-decodes URLs and rejects any input matching the Unicode BiDi and whitespace ranges from the upstream patch.
Render user-supplied URLs with explicit dir="ltr" and isolate the host portion using <bdi> elements to neutralize BiDi override effects.
Restrict acceptable URL characters to a strict allowlist before passing them to the HtmlSanitizer component.

bash

# Composer upgrade example for the 6.4 LTS branch
composer require symfony/html-sanitizer:^6.4.41
composer update symfony/html-sanitizer --with-dependencies
php bin/console cache:clear