Skip to content
OpenAdvisories

Package · Packagist

symfony/routing

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 5.1
    CVE-2026-48784

    Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encoding that skipped every other chained ../ or ./ segment, all…

    symfony symfony routing symfony/symfony Debian Ubuntu Packagist
  • Low 2.3
    CVE-2026-45065

    Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route parameters against a pattern built as ^ plus the raw requirement plus $; with ungrouped…

    symfony symfony nextcloud-server-33 symfony/symfony Debian Ubuntu Wolfi Packagist
  • High 7.5
    GHSA-rjpm-qmq7-q85w

    Symfony XXE security vulnerability

    Symfony 2.0.11 carried a [similar] XXE security fix, however, on review of ZF2 I also noted a vulnerability to XML Entity Expansion (XEE) attacks whereby all extensions making use of libxml2 have no defense against XEE Quadratic Blowup Attacks. The vulnerabil…

    symfony/routing Packagist
  • Medium —
    CVE-2012-6431

    Symfony Allows URI Restrictions Bypass Via Double-Encoded String

    Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.

    symfony/symfony symfony/security symfony/http-foundation symfony/routing Packagist