CVE-2026-31819: 
PHP vulnerability analysis and mitigation

CVE-2026-31819 is an open redirect vulnerability in Sylius, an open-source eCommerce framework built on Symfony. Three controllers — CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction(), and StorageBasedLocaleSwitcher::handle() — use the HTTP Referer header directly when constructing redirect responses, without validating that the destination is a trusted domain. The vulnerability was disclosed on March 9, 2026, and published to the NVD on March 10, 2026. It affects all Sylius versions up through 1.9.11, 1.10.0–1.10.15, 1.11.0–1.11.16, 1.12.0–1.12.22, 1.13.0–1.13.14, 1.14.0–1.14.17, 2.0.0–2.0.15, 2.1.0–2.1.11, and 2.2.0–2.2.2. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Sylius Advisory).

The root cause is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect). The vulnerable code in all three affected classes reads the raw Referer HTTP header and passes it directly to RedirectResponse without any origin validation — for example: return new RedirectResponse($request->headers->get('referer', $request->getSchemeAndHttpHost()));. An attacker hosts a page containing a legitimate Sylius link (e.g., a currency-switch or locale-switch URL); when a victim visits that page and clicks the link, the browser automatically sets the Referer header to the attacker's domain, and Sylius redirects the user back to it. Notably, even a partial fix introduced in Sylius 2.1.3 using UrlMatcherInterface remained exploitable because the full referer URL was still passed to RedirectResponse (Sylius Advisory, GitHub Advisory).

Successful exploitation allows attackers to redirect users from a trusted Sylius storefront domain to an attacker-controlled site, enabling phishing campaigns and credential theft. Because the redirect originates from the legitimate Sylius domain, victims are more likely to trust the destination. Public endpoints (CurrencySwitchController and StorageBasedLocaleSwitcher) require no authentication, making them trivially exploitable against any site visitor. The admin-only ImpersonateUserController endpoint is also vulnerable if an authenticated administrator follows a malicious link from an external source such as email or chat, potentially exposing admin credentials (GitHub Advisory, Sylius Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.055% (18th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Public endpoints are trivially exploitable without authentication, requiring only that a victim click a crafted link on an attacker-controlled page.

1. Set up attacker-controlled page: Host a webpage at an attacker-controlled domain (e.g., https://attacker.example.com/) containing a hyperlink pointing to a vulnerable Sylius endpoint, such as https://shop.victim.com/{_locale}/switch-currency/USD.
2. Lure victim to the page: Distribute the attacker's page URL via phishing email, social media, or other channels to attract Sylius shop users (or administrators for the impersonation endpoint).
3. Victim clicks the Sylius link: When the victim clicks the link from the attacker's page, the browser sends an HTTP GET request to the Sylius endpoint with the Referer header automatically set to https://attacker.example.com/.
4. Sylius processes the redirect: The vulnerable controller reads $request->headers->get('referer') and returns a RedirectResponse pointing to https://attacker.example.com/ without validating the destination.
5. Victim is redirected to attacker site: The victim's browser follows the redirect to the attacker's domain, where a convincing phishing page (e.g., a fake Sylius login form) can harvest credentials or session tokens (Sylius Advisory, GitHub Advisory).

• Network: HTTP 302 redirect responses from Sylius endpoints (e.g., /switch-currency/, locale-switch URLs, or admin impersonation URLs) pointing to external or unexpected domains; outbound traffic from the Sylius application server to unfamiliar external hosts.
• Logs: Web server or application access logs showing requests to currency-switch, locale-switch, or impersonation endpoints with Referer headers containing external domains not belonging to the Sylius installation; unusual referrer patterns in analytics or WAF logs.
• User Reports: End users or administrators reporting unexpected redirects to unfamiliar sites after clicking links within the Sylius storefront.

Sylius has released patched versions that replace the Referer-based redirect with a fixed internal route: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, and 2.2.3. Upgrading to the appropriate patched version is the recommended remediation. For operators unable to upgrade immediately, the official advisory provides a detailed workaround: copy the three affected classes (CurrencySwitchController, ImpersonateUserController, StorageBasedLocaleSwitcher) from the vendor directory into the project's src/ directory, replace the Referer-based redirect with $this->router->generate('sylius_shop_homepage') (or an appropriate named route), override the service definitions in config/services.yaml, and clear the cache with bin/console cache:clear. Additionally, implementing HTTP Referer header validation at the WAF or reverse proxy level to block external referers can reduce exposure (Sylius Advisory, GitHub Advisory).

Sylius published an official security blog post and GitHub Security Advisory (GHSA-9ffx-f77r-756w) crediting researcher Bartłomiej Nowiński (@bnBart) for responsible disclosure. The advisory includes detailed workaround instructions for operators who cannot immediately upgrade, reflecting a thorough vendor response. No significant broader media coverage or notable community controversy has been identified beyond the standard advisory channels (Sylius Advisory, Sylius Blog).