Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on , , , and <img>, and <meta http-equiv="refresh"> URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.</p></div> <div class="ds"><h2>Affected Platforms</h2><div><span class="ptag">Sensiolabs Symfony</span></div></div> <div class="ds"><h2>Weakness Type</h2><p>CWE-79, CWE-1023</p></div> <div class="ds"><h2>References</h2><ul style="list-style:none;display:flex;flex-direction:column;gap:0.4rem;"><li><a href="https://github.com/symfony/symfony/commit/069a70f9f26e61e9de3b7f9a864a86ed24b36bd0" target="_blank" rel="noopener">https://github.com/symfony/symfony/commit/069a70f9f26e61e9de3b7f9a864a86ed24b36b…</a></li><li><a href="https://github.com/symfony/symfony/releases/tag/v6.4.41" target="_blank" rel="noopener">https://github.com/symfony/symfony/releases/tag/v6.4.41</a></li><li><a href="https://github.com/symfony/symfony/releases/tag/v7.4.13" target="_blank" rel="noopener">https://github.com/symfony/symfony/releases/tag/v7.4.13</a></li><li><a href="https://github.com/symfony/symfony/releases/tag/v8.0.13" target="_blank" rel="noopener">https://github.com/symfony/symfony/releases/tag/v8.0.13</a></li><li><a href="https://github.com/symfony/symfony/security/advisories/GHSA-x5qj-865h-mgvm" target="_blank" rel="noopener">https://github.com/symfony/symfony/security/advisories/GHSA-x5qj-865h-mgvm</a></li></ul></div> </div> <div class="wrap"><footer><span>© 2025 Artfical DT</span><div style="display:flex;gap:1.2rem;"><a href="/privacy?lang=en">Privacy Policy</a><a href="https://artfical.com">artfical.com</a></div></footer></div> <script src="/__defend3r/badge.js" defer data-defend3r="1" data-position="br"></script></body></html>