Cyber Resilience

CVE-2026-45066

Sensiolabs Symfony 6.1.0 – 6.4.40

Published
14 July 2026
Modified
16 July 2026
Patch / advisory
CVSS Score v4 2.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0030 22th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-45066 is a low-severity Incomplete List of Disallowed Inputs (CWE-184) vulnerability in Sensiolabs Symfony. Its CVSS base score is 2.3 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts() or allowMediaHosts() because UrlSanitizer::parse() follows RFC 3986…

more

while browsers follow WHATWG URL parsing, and because <area href> is checked against the media policy rather than the link policy. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-47767Same product: Sensiolabs Symfony
CVE-2026-48736Same product: Sensiolabs Symfony
CVE-2026-45753Same product: Sensiolabs Symfony
CVE-2026-45073Same product: Sensiolabs Symfony
CVE-2026-45070Same product: Sensiolabs Symfony
CVE-2026-45071Same product: Sensiolabs Symfony
CVE-2026-45065Same product: Sensiolabs Symfony
CVE-2026-45754Same product: Sensiolabs Symfony
CVE-2023-46735Same product: Sensiolabs Symfony
CVE-2026-45072Same product: Sensiolabs Symfony

Affected Assets

sensiolabs
symfony
6.1.0 — 6.4.40 · 7.0.0 — 7.4.12 · 8.0.0 — 8.0.12

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 2 hardening rules · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V3.5.2
  • V4.4.2
  • V16.2.5

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation can discover cases where two products interpret the same inputs or state transitions differently.

SI-10 requires validity checks on inputs, which structurally replaces incomplete deny-lists with complete allow-list or sanitization logic.

Applying security engineering principles during design can require unambiguous protocol and data-format specifications that eliminate divergent interpretations between products.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require complete, positive input validation instead of incomplete denylists.

DE.AE-03 partial match
prevents

Correlating logs from multiple products can surface discrepancies caused by interpretation conflicts.

DE.CM-09 partial match
prevents

Runtime monitoring of software behavior can detect adverse outcomes stemming from differing interpretations.

GV.SC-07 partial match
prevents

Supplier risk assessments can identify products whose differing interpretations create systemic exposure.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can discover missing input checks, but does not prevent the weakness during development.

prevents

Secure development lifecycle can require consistent interface contracts and canonicalization rules that reduce interpretation conflicts between components.

prevents

Application security requirements can mandate complete input validation rules, but the control itself does not prescribe how to build those rules.

prevents

Secure architecture principles include robust input validation design, yet the control is broader than this single weakness.

prevents

Secure coding standards directly require exhaustive allow-lists or complete deny-lists for inputs, addressing the root cause of incomplete disallowed-input lists.

References