CLEANSTART-2026-WY33496: Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to be bypassed in Symfony versions prior to 5
Security vulnerability affects the drupal package. The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to be bypassed in Symfony versions prior to 5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/drupalto a version that resolves this vulnerability.Fixed in 11.4.11-r0 - Upgrade
Upgrade
cleanstart/drupalto a version that resolves this vulnerability.Fixed in 11.1.10-r0 - Upgrade
Upgrade
cleanstart/drupalto a version that resolves this vulnerability.Fixed in 11.2.14-r0
Frequently Asked Questions
Which deployments are most likely to be exposed?
Drupal deployments using Symfony Routing components in Symfony versions prior to 5 are affected when they rely on path-based authorization rules. The issue arises from differing host and path interpretation between CompiledUrlMatcher and UrlMatcher.
Does exploitation require an authenticated user or user interaction?
The supplied severity vector indicates the issue is network-reachable and requires neither privileges nor user interaction. It also indicates that attack prerequisites are present.
How can I determine whether this applies to my deployment?
Check whether the deployment uses Symfony Routing components from a Symfony version prior to 5 and whether authorization decisions depend on request paths. Deployments meeting both conditions should be treated as potentially affected.