Have found a security issue in Symfony? Send the details to
security [at] symfony.com and don't
disclose it publicly until we can provide a fix for it.
Manage your notification preferences to receive an email as soon as a Symfony security release is published.
The "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies
November 4, 2026
#Security Advisories
ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects
November 4, 2026
#Security Advisories
XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true
November 4, 2026
#Security Advisories
HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass
November 4, 2026
#Security Advisories
HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar: Incomplete Fix for CVE-2026-48761
November 4, 2026
#Security Advisories
Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses: SSRF Filter Bypass
November 4, 2026
#Security Advisories
HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066
November 4, 2026
#Security Advisories
Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
November 4, 2026
#Security Advisories
👍 1
The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File
November 4, 2026
#Security Advisories
HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls: Incomplete Fix for CVE-2026-45075
November 4, 2026
#Security Advisories