CVE-2026-45064 Sensiolabs CVE debrief

Who should care

Developers and administrators using Symfony versions 6.1.0-BETA1 through 6.4.40, 7.0.0 through 7.4.12, and 8.0.0 through 8.0.12 should be aware of this vulnerability and take steps to mitigate it. This vulnerability could allow attackers to deceive users into clicking on malicious links, potentially leading to phishing attacks or other security breaches.

Technical summary

The vulnerability exists in the UrlSanitizer::parse() method of the Symfony framework. This method is responsible for sanitizing URLs to prevent security vulnerabilities. However, it was found that this method does not properly remove Unicode explicit-direction BiDi formatting characters from sanitized href and src attributes. These characters can be used to manipulate the visual representation of links, allowing an attacker to create links that appear to point to a legitimate destination but actually lead to a malicious site. This can be used for phishing-style visual spoofing attacks, where the attacker can deceive users into clicking on what appears to be a trustworthy link but is actually malicious.

Defensive priority

Low

Recommended defensive actions

• Update Symfony to version 6.4.40, 7.4.12, or 8.0.12, or later
• Review and update any custom sanitization logic to ensure proper handling of BiDi characters
• Educate users about the risks of clicking on links from untrusted sources
• Implement additional security measures such as link validation and user awareness training
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail provide information about the vulnerability and its fix. The vendor, Sensiolabs, has released patches for the affected versions of Symfony. The vulnerability has been analyzed and assigned a CVSS score of 2.3, indicating a low severity.

Official resources