Skip to content
OpenAdvisories

Package · Packagist

symfony/routing

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.1
    CVE-2026-48784

    Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encoding that skipped every other chained ../ or ./ segment, all…

    symfony symfony routing symfony/symfony Debian Ubuntu Packagist
  • Medium —
    CVE-2012-6431

    Symfony Allows URI Restrictions Bypass Via Double-Encoded String

    Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.

    symfony/symfony symfony/security symfony/http-foundation symfony/routing Packagist