CVE-2026-45066
Sensiolabs Symfony 6.1.0 – 6.4.40
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-45066 is a low-severity Incomplete List of Disallowed Inputs (CWE-184) vulnerability in Sensiolabs Symfony. Its CVSS base score is 2.3 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-44339
Vulnerability Data
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts() or allowMediaHosts() because UrlSanitizer::parse() follows RFC 3986…
more
while browsers follow WHATWG URL parsing, and because <area href> is checked against the media policy rather than the link policy. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 1 OS baseline
V3.5.2V4.4.2V16.2.5
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover cases where two products interpret the same inputs or state transitions differently.
SI-10 requires validity checks on inputs, which structurally replaces incomplete deny-lists with complete allow-list or sanitization logic.
Applying security engineering principles during design can require unambiguous protocol and data-format specifications that eliminate divergent interpretations between products.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require complete, positive input validation instead of incomplete denylists.
Correlating logs from multiple products can surface discrepancies caused by interpretation conflicts.
Runtime monitoring of software behavior can detect adverse outcomes stemming from differing interpretations.
Supplier risk assessments can identify products whose differing interpretations create systemic exposure.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover missing input checks, but does not prevent the weakness during development.
Secure development lifecycle can require consistent interface contracts and canonicalization rules that reduce interpretation conflicts between components.
Application security requirements can mandate complete input validation rules, but the control itself does not prescribe how to build those rules.
Secure architecture principles include robust input validation design, yet the control is broader than this single weakness.
Secure coding standards directly require exhaustive allow-lists or complete deny-lists for inputs, addressing the root cause of incomplete disallowed-input lists.