CVE-2026-121949: 
PHP 脆弱性分析と緩和策

CVE-2026-121949 is a media URL allow-list bypass vulnerability in the Symfony HtmlSanitizer component (symfony/html-sanitizer). The sanitizer fails to validate URLs within the srcset attribute on <img> and <source> elements, and the imagesrcset attribute on <link> elements, allowing browsers to load images from hosts or schemes explicitly blocked by allowMediaHosts(), allowMediaSchemes(), or forceHttpsUrls() configuration. Affected versions are 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (GitHub Advisory, Feedly).

The root cause is an incomplete input validation list (CWE-184) combined with an incomplete comparison (CWE-1023): W3CReference::ATTRIBUTES marks srcset and imagesrcset as allowed attributes, but UrlAttributeSanitizer::getSupportedAttributes() does not include them, so no URL sanitizer is registered for either attribute. The DOM visitor preserves unhandled attribute values verbatim, meaning attacker-controlled responsive-image URL lists survive sanitization unchanged. This is a regression gap — prior fixes for CVE-2026-45753 and CVE-2026-48761 extended the same attribute list but omitted these two attributes. Exploitation requires the application to sanitize attacker-controlled HTML with a configuration that permits these attributes (via allowSafeElements(), allowStaticElements(), or explicit opt-in) and to rely on media URL restrictions (GitHub Advisory).

Successful exploitation allows an attacker to craft HTML containing srcset or imagesrcset values pointing to attacker-controlled or policy-violating hosts, which survive sanitization and cause the victim's browser to issue image requests to those hosts when viewing the sanitized content. This enables user tracking (via IP address and request metadata), potential data exfiltration through URL parameters, and content integrity violations. The confirmed primitive is a browser-active URL policy bypass — not JavaScript execution — so there is no direct availability impact and no server-side code execution risk (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable, requiring user interaction (a victim must view the sanitized content). The CVE status is "Received" and it is not listed in the CISA Known Exploited Vulnerabilities catalog. No EPSS score data is currently available (GitHub Advisory, Feedly).

1. Identify a target application: Find a Symfony application (versions 6.1.x < 6.4.50, 7.x < 7.4.23, or 8.x < 8.1.11) that accepts and sanitizes user-supplied HTML using HtmlSanitizer with allowSafeElements() or allowStaticElements() and enforces allowMediaHosts() or allowMediaSchemes() restrictions.
2. Craft malicious HTML payload: Construct an HTML snippet using the srcset attribute with a URL pointing to an attacker-controlled host, e.g., <img srcset="https://evil.example/track.png 1x"> or using a forbidden scheme such as <img srcset="http://evil.example/track.png 1x">.
3. Submit the payload: Inject the crafted HTML through any input vector the application sanitizes (e.g., a comment field, rich-text editor, or user profile bio).
4. Victim views the content: When a user views the page containing the sanitized HTML, their browser fetches the image from the attacker-controlled host, revealing the victim's IP address, browser fingerprint, and timing information to the attacker — enabling tracking or further targeted attacks (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from end-user browsers to unexpected external hosts originating from pages that render user-supplied sanitized HTML; requests to attacker-controlled domains carrying image-fetch headers (Accept: image/*, Referer pointing to the application).
• Logs: Application logs showing user-submitted HTML content containing srcset or imagesrcset attributes with external URLs; web server access logs on attacker infrastructure showing requests from victim IP addresses with referrer headers matching the vulnerable application.
• File System: No server-side file artifacts are expected, as exploitation occurs entirely in the victim's browser.

Upgrade symfony/html-sanitizer (or symfony/symfony) to the patched versions: 6.4.50, 7.4.23, or 8.1.11. The fix registers a proper URL sanitizer for srcset and imagesrcset that parses the comma-separated candidate list per HTML srcset parsing rules, validates each candidate URL against the media policy, drops rejected candidates, and removes the attribute entirely if all candidates are rejected. The patch also requires the fix for CVE-2026-118517 to correctly handle candidates written without //. No configuration-based workaround is available short of explicitly disallowing srcset and imagesrcset attributes in the sanitizer configuration (GitHub Advisory).

The advisory was published by Symfony maintainer fabpot on November 4, 2026, crediting three independent reporters: Shriyansh Gupta, Ilia Alshanetsky, and 李智遥. The severity was rated Low by the Symfony security team given that exploitation requires specific configuration and user interaction, and the impact is limited to URL policy bypass rather than code execution. No significant broader media coverage or social media discussion has been observed beyond standard CVE aggregator publications (GitHub Advisory).