CVE-2026-118516: 
PHP vulnerability analysis and mitigation

CVE-2026-118516 is an authorization bypass vulnerability in the Symfony Routing component caused by a behavioral difference between CompiledUrlMatcher and UrlMatcher when processing host placeholders. Disclosed on November 4, 2026, it affects symfony/routing versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. An unauthenticated remote attacker can craft a malicious Host header and request path to bypass path-based access controls (e.g., access_control rules and firewall patterns) and reach protected controllers. It carries a CVSS v4.0 base score of 6.3 (Medium) (Symfony Advisory, GitHub Advisory).

The root cause is an interpretation conflict (CWE-436) combined with incorrect authorization (CWE-863) arising from how CompiledUrlMatcher constructs its matching subject. For routes with a host constraint, CompiledUrlMatcher concatenates $host . '.' . $pathinfo and matches this combined string against the host regexp followed by the path regexp sequentially. Because host placeholders use patterns that can match /, a placeholder can consume the leading portion of the path, causing the route to match when UrlMatcher — which evaluates host and path separately — would find no match. Path-based security rules such as access_control entries and firewall patterns are evaluated against the actual request path, not the combined string, so they do not fire for the mismatched route, allowing the controller to execute without authorization checks. For example, with route /admin/report/{id}, host app.{domain}, and rule access_control: [{ path: ^/admin, roles: ROLE_ADMIN }], a request with Host: app and path /x./admin/report/1 reaches the controller with domain="/x" (GitHub Advisory, Symfony Advisory).

Successful exploitation allows an unauthenticated attacker to bypass path-based access controls and reach controllers that should require authentication or specific roles (e.g., ROLE_ADMIN). The confidentiality and integrity of the vulnerable system are both rated Low under CVSS v4.0, reflecting the potential for unauthorized data access or modification depending on what the protected controller exposes. Applications are most at risk when they rely on access_control rules or firewall path patterns as their primary authorization mechanism for routes that also define host placeholders. The vulnerability does not affect availability and has no impact on subsequent systems (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). Exploitation requires specific preconditions: the application must have routes with host placeholders protected by path-based rules, and the web server or proxy must forward arbitrary Host headers to the application (e.g., nginx passing raw Host headers via FastCGI). The framework.trusted_hosts configuration in Symfony can mitigate the default-requirement variant but does not help when the host placeholder requirement accepts / (e.g., .+). No CISA KEV listing or threat actor attribution has been observed.

1. Reconnaissance: Identify a Symfony application running a vulnerable version of symfony/routing (< 5.4.56, < 6.4.50, < 7.4.23, or < 8.1.11) that defines routes with host placeholders (e.g., app.{domain}) and protects paths using access_control or firewall patterns.
2. Identify target route: Determine a protected route such as /admin/report/{id} that is guarded by a path-based rule (e.g., access_control: [{ path: ^/admin, roles: ROLE_ADMIN }]) and has a host constraint with a placeholder.
3. Craft malicious request: Send an HTTP request with a manipulated Host header and path that exploits the CompiledUrlMatcher concatenation behavior:
   • For default host placeholder requirements: Set Host: app and request path /x./admin/report/1. The matcher evaluates app./x./admin/report/1, where {domain} matches /x, satisfying the host regexp and routing to the controller.
   • For permissive requirements (e.g., domain: .+): Set Host: app.example.com and request path /x./admin/report/1, where {domain} matches example.com./x.
4. Bypass access control: Because path-based rules evaluate the actual request path (/x./admin/report/1), which does not match ^/admin, the access_control rule does not apply and the controller executes without authentication.
5. Access protected resource: The controller runs with the attacker-controlled parameters, potentially exposing sensitive data or functionality intended only for authenticated/authorized users (GitHub Advisory, Symfony Advisory).

• Network: HTTP requests with unusual Host headers (e.g., short hostnames like app without a domain suffix) combined with paths containing embedded dot-slash sequences (e.g., /x./admin/... or /something./protected/path).
• Logs: Web server or application access logs showing requests where the path contains a pattern like /<segment>./admin/ or similar dot-slash constructs that do not match normal application URL patterns; requests to protected endpoints (e.g., /admin/) that were not preceded by an authentication redirect.
• Application Behavior: Controller execution logs for protected routes triggered without a corresponding authentication event or session token; unexpected route parameter values containing / characters in host-bound variables (e.g., domain="/x").

Upgrade symfony/routing (or symfony/symfony) to one of the patched versions: 5.4.56, 6.4.50, 7.4.23, or 8.1.11 depending on the branch in use. After upgrading, clear the application cache, as the fix is in the route dumper and vulnerable compiled routes remain active until the cache is regenerated. As a partial workaround for the default-requirement variant, configure framework.trusted_hosts to restrict accepted Host header values; however, this does not protect routes with permissive host placeholder requirements (e.g., domain: .+). Consider supplementing path-based access_control rules with controller-level authorization checks as defense in depth (GitHub Advisory, Symfony Advisory).

The vulnerability was reported by Vincent Cassiau of CyberVanguard, with the fix provided by Nicolas Grekas (Symfony core contributor). Bruno Dias and Ana Lisboa from Checkmarx assisted in obtaining the CVE assignment. The advisory was published by Symfony maintainer fabpot and rated Moderate severity, reflecting the specific preconditions required for exploitation (GitHub Advisory).