CVE-2026-118517: 
PHP vulnerability analysis and mitigation

CVE-2026-118517 is an authorization bypass vulnerability in Symfony's HtmlSanitizer component, specifically in UrlSanitizer, where host allow-lists can be bypassed via malformed URL authorities. It is an incomplete fix for a prior vulnerability, CVE-2026-45066. Affected packages are symfony/html-sanitizer and symfony/symfony versions >=6.1 <6.4.50, >=7 <7.4.23, and >=8 <8.1.11. The vulnerability was disclosed on November 4, 2026, with patches available the same day. It carries a Low severity rating (Symfony Advisory, GitHub Advisory).

The root cause is classified under CWE-184 (Incomplete List of Disallowed Inputs) and CWE-436 (Interpretation Conflict). UrlSanitizer uses league/uri to parse URLs per RFC 3986, which for zero-slash scheme URLs like http:evil.example returns a null host and a path of evil.example. Because the host is null, the sanitizer skips the allow-list check; when allowRelativeLinks(true) is set, it also waives rejection of hostless URLs, allowing the malformed URL to pass through unchanged. Browsers, however, parse the same string under the WHATWG URL standard and resolve evil.example as the authority, navigating users to the attacker-controlled domain. The guard introduced for CVE-2026-45066 only blocked one-slash (http:/evil.example) and three-slash (http:///evil.example) forms via the regex ~^(?:https?|ftp|wss?):(/[^/]|///)~i, leaving the zero-slash form unblocked. Additional bypass variants include scheme-relative URLs with three or more slashes (///evil.example) and empty-authority URLs (https://://evil.example/) (GitHub Advisory).

An unauthenticated attacker can craft malformed URLs that survive HTML sanitization and redirect users who click them to attacker-controlled domains, enabling phishing, credential harvesting, or malware delivery. The bypass only applies when both a host allow-list and allowRelativeLinks(true) (or allowRelativeMedias(true)) are configured — a common content-management setup — so the default configuration is not affected. The media policy is equally affected under allowRelativeMedias(true), potentially allowing injection of attacker-controlled media resources (GitHub Advisory, Symfony Advisory).

There is no evidence of public proof-of-concept exploit code or in-the-wild exploitation at this time. The vulnerability requires a specific opt-in configuration (host allow-list combined with allowRelativeLinks(true)), which limits the attack surface. No threat actor attribution or CISA KEV catalog listing has been identified. The EPSS score is not yet available given the recent disclosure date (GitHub Advisory, Symfony Advisory).

1. Identify target: Find a web application using Symfony's HtmlSanitizer with a configuration that includes both allowLinkHosts([...]) and allowRelativeLinks(true) — typical in CMS-style deployments.
2. Craft malformed URL: Construct a URL using a zero-slash scheme such as http:evil.example/login or http:evil.example/phishing-page, which RFC 3986 parses as having a null host but browsers resolve as the authority evil.example.
3. Inject into sanitized content: Submit HTML content containing the malformed URL (e.g., <a href="http:evil.example/login">Click here</a>) through any user-controlled input field that passes through the sanitizer.
4. Bypass sanitization: The sanitizer skips the host allow-list check because the parsed host is null, and allowRelativeLinks(true) prevents rejection of hostless URLs, so the link passes through unchanged.
5. User redirection: When a victim clicks the link in the rendered page, their browser resolves http:evil.example/login to http://evil.example/login and navigates to the attacker-controlled domain, enabling phishing or credential theft (GitHub Advisory).

• Logs: Application logs showing HTML content submissions containing URLs matching patterns like https?:[^/][^/], ///, or https?://:// in href or src attributes.
• Network: Outbound user traffic to unexpected domains following clicks on sanitized content; referrer headers from the Symfony application pointing to attacker-controlled domains.
• File System / Content: Stored HTML content in the database or CMS containing anchor tags with zero-slash scheme URLs (e.g., href="http:evil.example/...") that were not stripped by the sanitizer.

Update to the patched versions: symfony/html-sanitizer and symfony/symfony versions 6.4.50, 7.4.23, or 8.1.11. The fix requires special schemes (http, https, ftp, ws, wss) to be followed by exactly //, closing zero-, one-, and three-slash bypass spellings, and rejects URLs with an empty authority. As a workaround, disable allowRelativeLinks(true) and allowRelativeMedias(true) if not strictly required, as the default configuration (relative links disabled) is not affected. Review and test sanitizer configurations with malformed URL authorities to verify allow-lists are enforced correctly (GitHub Advisory, Symfony Advisory).

The vulnerability was reported by Ilia Alshanetsky, with CVE assignment assistance from Bruno Dias and Catarina Amorim of Checkmarx. The fix was developed by nicolas-grekas from the Symfony core team. The advisory was rated Low severity by Symfony, reflecting the limited attack surface due to the required opt-in configuration (GitHub Advisory).