MEDIUMPackagist
GHSA-72xp-p242-47p9· CVE-2026-45065Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
Modified: 9/10/2026
package
Packagist/symfony/routing
pkg:packagist/symfony/routing
MEDIUMPackagist
GHSA-83c3-qx27-2rwr· CVE-2012-6431Symfony Allows URI Restrictions Bypass Via Double-Encoded String
Modified: 12/3/2024
MEDIUMPackagist
GHSA-h5x3-xfc9-m39h· CVE-2026-48784Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
Modified: 9/10/2026
HIGH7.5Packagist
GHSA-rjpm-qmq7-q85wSymfony XXE security vulnerability
Modified: 12/4/2024