VulnSocial

CVE-2026-48761Disclosure(sensiolabs / symfony)

LOWCVSS 6.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.

sensiolabs CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-79CWE-1023

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • symfony

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
sensiolabs
Products
symfony

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-06-15: 1Technical Details · 2026-06-15: 106-15
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • DailyCVE@dailycve
    Disclosure

    🟠 Symfony HtmlSanitizer, Multiple XSS Vulnerabilities (#CVE-2026-48761 &amp; #CVE-2026-45753) (Medium) -DC-Jun2026-402 https://dailycve.com/symfony-htmlsanitizer-multiple-xss-vulnerabilities-cve-2026-48761-cve-2026-45753-medium-dc-jun2026-402/

    Post summary

    The post announces multiple medium‑severity XSS vulnerabilities in Symfony HtmlSanitizer (CVE‑2026‑48761 & CVE‑2026‑45753), linking to a DailyCVE article but offering no PoC, exploit, or patch details.

    0000033
    212 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appsensiolabssymfony---

Explore more

Back to dashboardsensiolabs CVEssymfony vulnerabilities