Junglewise Threat Intelligence

CVE-2026-45064: Symfony HtmlSanitizer visual spoofing via BiDi override characters

CVE-2026-45064 · Severity: medium · CVSS 4 · Published 2026-07-14

Technologies: Symfony HtmlSanitizer, Symfony. Vendors: Symfony.

Executive brief

Symfony is a popular PHP framework used to build web applications. A vulnerability in its HTML sanitization component allows attackers to create links that look like they lead to a safe website but actually direct users to a different, potentially malicious destination. This could be used in phishing attacks to trick users into visiting fraudulent sites or downloading harmful content.

Technical details

A vulnerability exists in the Symfony HtmlSanitizer component where the UrlSanitizer::parse() method fails to filter Unicode explicit-direction BiDi (Bidirectional) formatting characters. These characters are passed through into sanitized 'href' and 'src' attributes. An attacker can exploit this by crafting URLs that use BiDi overrides to visually misrepresent the link destination to a user, facilitating phishing attacks. The vulnerability affects versions starting from 6.1.0-BETA1 and is fixed in versions 6.4.40, 7.4.12, and 8.0.12. The fix involves rejecting BiDi override characters and ensuring proper percent-encoding of spaces in URLs.

Affected products

  • symfony symfony >= 6.1.0-BETA1, < 6.4.40
  • symfony symfony >= 7.0.0-BETA1, < 7.4.12
  • symfony symfony >= 8.0.0-BETA1, < 8.0.12
  • symfony html-sanitizer >= 6.1.0-BETA1, < 6.4.40
  • symfony html-sanitizer >= 7.0.0-BETA1, < 7.4.12
  • symfony html-sanitizer >= 8.0.0-BETA1, < 8.0.12

Timeline

  • 2026-07-14: advisory
  • 2026-07-14: disclosed
  • 2026-05-20: patched

References

Related threats