MediumGHSA-72xp-p242-47p9CVE-2026-45065

Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

Published 27 May 2026 · Updated 10 Sept 2026

Affected packages

symfony/routingComposer
Affected
<5.4.52
Fixed in
5.4.52
Update to the fixed version for your release line, for example:composer require symfony/routing:^5.4.52
symfony/routingComposer
Affected
>=6.0.0 <6.4.40
Fixed in
6.4.40
Update to the fixed version for your release line, for example:composer require symfony/routing:^6.4.40
symfony/routingComposer
Affected
>=7.0.0 <7.4.12
Fixed in
7.4.12
Update to the fixed version for your release line, for example:composer require symfony/routing:^7.4.12
symfony/routingComposer
Affected
>=8.0.0 <8.0.12
Fixed in
8.0.12
Update to the fixed version for your release line, for example:composer require symfony/routing:^8.0.12
symfony/symfonyComposer
Affected
<5.4.52
Fixed in
5.4.52
Update to the fixed version for your release line, for example:composer require symfony/symfony:^5.4.52
symfony/symfonyComposer
Affected
>=6.0.0 <6.4.40
Fixed in
6.4.40
Update to the fixed version for your release line, for example:composer require symfony/symfony:^6.4.40
symfony/symfonyComposer
Affected
>=7.0.0 <7.4.12
Fixed in
7.4.12
Update to the fixed version for your release line, for example:composer require symfony/symfony:^7.4.12
symfony/symfonyComposer
Affected
>=8.0.0 <8.0.12
Fixed in
8.0.12
Update to the fixed version for your release line, for example:composer require symfony/symfony:^8.0.12

Details

Description

Symfony routes can declare a requirements regex per path parameter, e.g. a route /{_locale}/blog with requirements: { _locale: 'en|fr|de' }. The Twig path() / url() helpers (backed by UrlGenerator) validate supplied parameter values against that regex before building the URL.

UrlGenerator constructs the validation pattern as '#^'.$req.'$#', where $req is the raw requirement string. For a requirement expressed as an alternation, e.g. _locale: 'ar|bg|...|vi|...|zh_CN' (very common), ^ and $ anchor only the first and last alternatives, so any middle alternative matches as an unanchored substring. A value like /evil.com satisfies the requirement (because it contains vi), and the generated path becomes //evil.com/...: a protocol-relative URL the browser navigates off-site.

Resolution

The UrlGenerator class now wraps the requirement in a non-capturing group so the ^ and $ anchors apply to the whole alternation.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Is GHSA-72xp-p242-47p9 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/routing, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.