CVE-2026-118517: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066

Q: Which configurations are actually exposed to this bypass?

Exposure requires a host allow-list configured through allowLinkHosts() or allowMediaHosts() together with allowRelativeLinks(true) or allowRelativeMedias(true), respectively. The default configuration is not affected.

Q: What does an attacker need to submit to bypass the host allow-list?

An attacker needs to supply a URL that lacks a well-formed authority, causing the sanitizer and browser to interpret its host differently. Examples include http:evil.example, ///evil.example, and https://://evil.example/; the zero-slash form missed by the prior fix and host 0 are also relevant.

Q: What is the impact after successful exploitation?

Sanitized output can contain links or media references to untrusted hosts despite the configured host allow-list. The provided impact information identifies integrity impact as low and does not identify confidentiality or availability impact.

Q: Which Symfony releases need updating?

Affected releases are Symfony 6.1.x before 6.4.50, 7.x before 7.4.23, and 8.x before 8.1.11. The issue applies to the Symfony HtmlSanitizer component and Symfony package distributions listed in the advisory data.

Published Nov 4, 2026

Updated

CVE-2026-118517: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066

Other sources

The Symfony HtmlSanitizer component UrlSanitizer parses URLs differently from browsers, allowing the allowLinkHosts() and allowMediaHosts() checks to be bypassed for URLs without a well-formed authority, resulting in untrusted hosts being referenced in sanitized output in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.

UrlSanitizer parses URLs with league/uri, which follows RFC 3986, while browsers follow the WHATWG URL standard. For URLs without a well-formed authority, such as http:evil.example, ///evil.example, or https://://evil.example/ the sanitizer finds no host, whereas browsers resolve them to evil.example. The guard added for CVE-2026-45066 missed the zero-slash form, and the host 0 was also skipped because PHP treats it as falsy.

This is exploitable when a host allow-list is combined with allowRelativeLinks(true) or allowRelativeMedias(true). The default configuration is not affected.

— MITRE

Affected Software

26 affected componentsFixes available

composer/symfony/symfony>=6.1.0, <6.2.0

composer/symfony/symfony>=6.2.0, <6.3.0

composer/symfony/symfony>=6.3.0, <6.4.0

composer/symfony/symfony>=6.4.0, <6.4.50

6.4.50

composer/symfony/symfony>=7.0.0, <7.1.0

composer/symfony/symfony>=7.1.0, <7.2.0

composer/symfony/symfony>=7.2.0, <7.3.0

composer/symfony/symfony>=7.3.0, <7.4.0

composer/symfony/symfony>=7.4.0, <7.4.23

7.4.23

composer/symfony/symfony>=8.0.0, <8.1.0

composer/symfony/symfony>=8.1.0, <8.1.11

8.1.11

composer/symfony/html-sanitizer>=6.1.0, <6.2.0

composer/symfony/html-sanitizer>=6.2.0, <6.3.0

composer/symfony/html-sanitizer>=6.3.0, <6.4.0

composer/symfony/html-sanitizer>=6.4.0, <6.4.50

6.4.50

composer/symfony/html-sanitizer>=7.0.0, <7.1.0

composer/symfony/html-sanitizer>=7.1.0, <7.2.0

composer/symfony/html-sanitizer>=7.2.0, <7.3.0

composer/symfony/html-sanitizer>=7.3.0, <7.4.0

composer/symfony/html-sanitizer>=7.4.0, <7.4.23

7.4.23

composer/symfony/html-sanitizer>=8.0.0, <8.1.0

composer/symfony/html-sanitizer>=8.1.0, <8.1.11

8.1.11

debian/symfony*

debian/symfony<=5.4.53+dfsg-0+deb12u1, <=6.4.41+dfsg-0+deb13u1, <=6.4.49+dfsg-0+deb13u1, <=7.4.22+dfsg-1

7.4.23+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 6.4.50
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 7.4.23
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 8.1.11
Upgrade
Upgrade composer/symfony/html-sanitizer to a version that resolves this vulnerability.
Fixed in 6.4.50
Upgrade
Upgrade composer/symfony/html-sanitizer to a version that resolves this vulnerability.
Fixed in 7.4.23
Upgrade
Upgrade composer/symfony/html-sanitizer to a version that resolves this vulnerability.
Fixed in 8.1.11
Upgrade
Upgrade debian/symfony to a version that resolves this vulnerability.
Fixed in 7.4.23+dfsg-1
Upgrade
Upgrade Symfony HtmlSanitizer to a version that resolves this vulnerability.
Fixed in 6.4.50
Upgrade
Upgrade Symfony HtmlSanitizer to a version that resolves this vulnerability.
Fixed in 7.4.23
Upgrade
Upgrade Symfony HtmlSanitizer to a version that resolves this vulnerability.
Fixed in 8.1.11

Event History

Nov 4, 2026

Advisory Published

via Packagist·11:23 AM

Data Sourced

via Packagist·11:23 AM

DescriptionSeverityAffected Software

Nov 5, 2026

CVE Published

via OSV·07:47 AM

Data Sourced

via OSV·07:47 AM

DescriptionAffected Software

CVE Published

via MITRE·04:26 PM

Data Sourced

via MITRE·04:26 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which configurations are actually exposed to this bypass?

Exposure requires a host allow-list configured through allowLinkHosts() or allowMediaHosts() together with allowRelativeLinks(true) or allowRelativeMedias(true), respectively. The default configuration is not affected.

What does an attacker need to submit to bypass the host allow-list?

An attacker needs to supply a URL that lacks a well-formed authority, causing the sanitizer and browser to interpret its host differently. Examples include http:evil.example, ///evil.example, and https://://evil.example/; the zero-slash form missed by the prior fix and host 0 are also relevant.

What is the impact after successful exploitation?

Sanitized output can contain links or media references to untrusted hosts despite the configured host allow-list. The provided impact information identifies integrity impact as low and does not identify confidentiality or availability impact.

Which Symfony releases need updating?

Affected releases are Symfony 6.1.x before 6.4.50, 7.x before 7.4.23, and 8.x before 8.1.11. The issue applies to the Symfony HtmlSanitizer component and Symfony package distributions listed in the advisory data.

CVE-2026-118517: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which configurations are actually exposed to this bypass?

What does an attacker need to submit to bypass the host allow-list?

What is the impact after successful exploitation?

Which Symfony releases need updating?

Company

Resources

Contact

Frequently Asked Questions

Which configurations are actually exposed to this bypass?

What does an attacker need to submit to bypass the host allow-list?

What is the impact after successful exploitation?

Which Symfony releases need updating?