CVE-2026-48761: Sensiolabs Symfony XSS Vulnerability

CVE-2026-48761 Overview

CVE-2026-48761 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Symfony PHP framework's HtmlSanitizer component. The flaw affects Symfony versions from 6.1.0 up to 6.4.41, 7.4.13, and 8.0.13. The UrlAttributeSanitizer::getSupportedAttributes() method omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img> elements. Additionally, URLs contained within <meta http-equiv="refresh"> content bypassed URL sanitization entirely. When applications explicitly enabled these elements or attributes, attackers could pass javascript: and similar payloads through to sanitized output.

Critical Impact
Attackers can inject javascript: URIs through allow-listed HTML elements and attributes, bypassing the HtmlSanitizer defense and enabling stored or reflected XSS in Symfony applications relying on the sanitizer to strip dangerous URL schemes.

Affected Products

Symfony 6.1.0 through 6.4.40
Symfony 7.0.0 through 7.4.12
Symfony 8.0.0 through 8.0.12

Discovery Timeline

2026-07-14 - CVE-2026-48761 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-48761

Vulnerability Analysis

The HtmlSanitizer component is Symfony's defense against XSS when rendering user-supplied HTML. It relies on per-attribute sanitizers to strip dangerous URL schemes such as javascript:, data:, and vbscript:. This vulnerability arises from two gaps in coverage.

First, UrlAttributeSanitizer::getSupportedAttributes() did not enumerate every URL-bearing attribute. Elements such as <object codebase="…">, <applet archive="…">, <iframe src="…">, and <img longdesc="…"> were not routed through URL sanitization. When an application configuration explicitly allowed these elements or attributes, hostile URLs passed unchanged.

Second, the <meta http-equiv="refresh" content="0;url=javascript:…"> construct was not inspected. The URL is embedded inside the content attribute, and the http-equiv distinction is not visible to a per-attribute sanitizer. This allowed refresh-based navigation to a javascript: URI to survive sanitization.

Root Cause

The root cause is incomplete attribute coverage in the URL sanitizer's allow list combined with a missing element-scoped sanitizer for <meta http-equiv="refresh">. The design assumed per-attribute inspection was sufficient, but the content attribute on <meta> carries different semantics depending on sibling attribute values.

Attack Vector

Exploitation requires that the target Symfony application uses HtmlSanitizer with a configuration explicitly allowing one of the affected elements or attributes. An attacker submits HTML containing a payload such as <iframe src="javascript:alert(1)"> or <meta http-equiv="refresh" content="0;url=javascript:alert(1)">. When the sanitized output is rendered and a victim interacts with the page, the script executes in the victim's browser context.

php

// Patch: Register a dedicated MetaRefreshAttributeSanitizer
{
    $this->attributeSanitizers = [
        new Visitor\AttributeSanitizer\UrlAttributeSanitizer(),
+       new Visitor\AttributeSanitizer\MetaRefreshAttributeSanitizer(),
    ];
}

// New sanitizer scoped to <meta> elements
final class MetaRefreshAttributeSanitizer implements AttributeSanitizerInterface
{
    public function getSupportedElements(): ?array
    {
        return ['meta'];
    }
    // Sanitizes the URL embedded in the content attribute of
    // a <meta http-equiv="refresh"> element.
}

Source: Symfony patch commit 069a70f

Detection Methods for CVE-2026-48761

Indicators of Compromise

HTTP request bodies or query parameters containing javascript:, vbscript:, or data:text/html schemes targeting src, codebase, archive, or longdesc attributes.
Stored HTML content in the database containing <meta http-equiv="refresh" combined with url=javascript:.
Web server logs showing repeated submissions of <iframe>, <object>, <applet>, or <img> tags to endpoints that accept rich text.

Detection Strategies

Audit application code and configuration for calls to HtmlSanitizerConfig::allowElement() or allowAttribute() that enable object, applet, iframe, img, or meta.
Scan stored user-generated HTML for javascript: URIs within src, href, codebase, archive, longdesc, or <meta refresh>content values.
Enable Content Security Policy (CSP) violation reporting to surface inline script executions originating from sanitized fields.

Monitoring Recommendations

Log and alert on outbound Content-Security-Policy report-uri events indicating javascript: navigations.
Monitor Symfony application logs for HtmlSanitizer invocations tied to user-input rendering paths.
Track dependency versions with a Software Composition Analysis (SCA) tool to flag hosts still running vulnerable Symfony releases.

How to Mitigate CVE-2026-48761

Immediate Actions Required

Upgrade Symfony to 6.4.41, 7.4.13, or 8.0.13 depending on the branch in use.
Review HtmlSanitizerConfig definitions and remove any unnecessary allow-listing of <object>, <applet>, <iframe>, <img>, or <meta> elements.
Purge or re-sanitize stored HTML content submitted before the patch was applied.

Patch Information

Symfony released fixes in v6.4.41, v7.4.13, and v8.0.13. The fix adds MetaRefreshAttributeSanitizer and extends UrlAttributeSanitizer to cover the missing URL-bearing attributes. See the GitHub Security Advisory GHSA-x5qj-865h-mgvm for full details.

Workarounds

Explicitly disallow <object>, <applet>, <iframe>, <img>, and <meta> elements in HtmlSanitizerConfig until the upgrade is deployed.
Deploy a strict Content Security Policy that blocks javascript: URIs and inline script execution as a defense-in-depth control.
Apply an application-layer filter that rejects any submitted HTML matching /javascript\s*:/i before invoking the sanitizer.

bash

# Upgrade Symfony via Composer to the patched release
composer require symfony/html-sanitizer:^6.4.41
# or
composer require symfony/html-sanitizer:^7.4.13
# or
composer require symfony/html-sanitizer:^8.0.13

# Verify installed version
composer show symfony/html-sanitizer