CVE-2026-48784: Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-14 · updated 2026-07-15
Weakness: CWE-172

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters to generate URLs that collapse to a different path under RFC 3986 normalization. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

Affected products

symfony: before 5.4.53; from 6.0.0 before 6.4.41; from 7.0.0 before 7.4.13; from 8.0.0 before 8.0.13 — fixed in 5.4.53, 6.4.41, 7.4.13, 8.0.13
Packagist Symfony/Routing: before 5.4.53; from 6.0.0 before 6.4.41; from 7.0.0 before 7.4.13; from 8.0.0 before 8.0.13; 2.0.4, 2.0.5, 2.0.6, 2.0.7, v2.0.10, v2.0.12 (+613) — fixed in 5.4.53, 6.4.41, 7.4.13, 8.0.13
Packagist Symfony/Symfony: before 5.4.53; from 6.0.0 before 6.4.41; from 7.0.0 before 7.4.13; from 8.0.0 before 8.0.13; 2.0.4, 2.0.5, 2.0.6, 2.0.7, v2.0.10, v2.0.11 (+699) — fixed in 5.4.53, 6.4.41, 7.4.13, 8.0.13

How to fix

Upgrade to a fixed version: symfony 5.4.53, 6.4.41, 7.4.13, 8.0.13; Packagist Symfony/Routing 5.4.53, 6.4.41, 7.4.13, 8.0.13; Packagist Symfony/Symfony 5.4.53, 6.4.41, 7.4.13, 8.0.13. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-48784 or the next vulnerability affects your stack