Beschreibung
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv=-refresh-> URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.
CVSS 6.1EPSS 0.268%Risiko 0.62
Quelle öffnen- Veröffentlicht
- 2026-07-14 20:17:10
- Betroffene Versionen
- <6.4.41, <7.4.13, <8.0.13
- Typ
- Bibliothek
- Zuletzt geändert
- 2026-07-21 19:17:10
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N