Junglewise Threat Intelligence

CVE-2026-48760: Symfony HtmlSanitizer visual spoofing via percent-encoded BiDi characters

CVE-2026-48760 · Severity: medium · CVSS 0 · Published 2026-07-14

Technologies: Symfony HtmlSanitizer, Symfony. Vendors: Symfony.

Executive brief

Symfony, a popular framework for building PHP web applications, contains a flaw in its URL sanitization component. This component is responsible for cleaning user-provided links to ensure they are safe to display. An attacker could bypass these security checks to include hidden characters that visually spoof URLs, potentially leading users to malicious websites or facilitating phishing attacks.

Technical details

A vulnerability exists in the Symfony HtmlSanitizer component's UrlSanitizer::parse() method. While the parser was designed to reject raw Bidirectional (BiDi) formatting characters, it failed to account for percent-encoded versions of these characters. Additionally, the component utilized an ASCII-only whitespace check, failing to identify and strip Unicode whitespace characters. This allows an attacker to craft URLs that appear legitimate to a user but contain hidden or spoofed characters that downstream consumers (like browsers or other services) may decode or display differently. The issue is resolved by hardening the parser to reject percent-encoded BiDi marks and expanding whitespace detection to include Unicode characters.

Affected products

  • symfony symfony >= 6.1.0, < 6.4.41; >= 7.0.0-BETA1, < 7.4.13; >= 8.0.0-BETA1, < 8.0.13
  • symfony html-sanitizer >= 6.1.0, < 6.4.41; >= 7.0.0-BETA1, < 7.4.13; >= 8.0.0-BETA1, < 8.0.13

Timeline

  • 2026-05-27: patched: Fixed in versions 6.4.41, 7.4.13, and 8.0.13
  • 2026-07-14: advisory: Public advisory and CVE published

References

Related threats