Advisories via FriendsOfPHP

Listing reported advisories via FriendsOfPHP sorted by their report date.

Cross-site scripting (XSS) via script break-out in toScript() output
FriendsOfPHP

spatie/schema-org

>=3.23.1, <3.23.2 · >=4.0.0, <4.0.2

2026-05-29 07:46:00
Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` and `in`/`not in` operators
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
Sandbox `__toString()` policy bypass via dynamic mapping keys
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders
FriendsOfPHP

twig/twig

>=3.0.0, <3.27.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-27 15:00:00
CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-26 08:00:00
CVE-2026-48761: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-26 08:00:00
CVE-2026-48760: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-26 08:00:00
CVE-2026-48747: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0

2026-05-26 08:00:00
CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2026-05-26 08:00:00
CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-26 08:00:00
CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
FriendsOfPHP

symfony/security-http

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-26 08:00:00
CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
FriendsOfPHP

symfony/routing

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=5.4.0, <5.4.53 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-26 08:00:00
CVE-2026-48747: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
FriendsOfPHP

symfony/mailomat-mailer

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0

2026-05-26 08:00:00
CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/http-foundation

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2026-05-26 08:00:00
CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/http-client

>=5.4.0, <5.4.53

2026-05-26 08:00:00
CVE-2026-48761: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content
FriendsOfPHP

symfony/html-sanitizer

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-26 08:00:00
CVE-2026-48760: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
FriendsOfPHP

symfony/html-sanitizer

>=8.0.0, <8.0.13 · >=7.4.0, <7.4.13 · >=6.4.0, <6.4.41 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-26 08:00:00
CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
FriendsOfPHP

symfony/polyfill

>=1.17.1, <1.38.1

2026-05-26 08:00:00
CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
FriendsOfPHP

symfony/polyfill-intl-idn

>=1.17.1, <1.38.1

2026-05-26 08:00:00
Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-20 08:00:00
XSS in profiler HtmlDumper via unescaped template and profile names
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0

2026-05-20 08:00:00
Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
FriendsOfPHP

twig/twig

>=3.15.0, <3.26.0

2026-05-20 08:00:00
Sandbox property and method bypass via object-destructuring assignment
FriendsOfPHP

twig/twig

>=3.24.0, <3.26.0

2026-05-20 08:00:00
`{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-20 08:00:00
Sandbox property allowlist bypass via the `column` filter (array_column on objects)
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-20 08:00:00
`template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
FriendsOfPHP

twig/twig

>=3.9.0, <3.26.0

2026-05-20 08:00:00
PHP code injection via `{% use %}` template name
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-20 08:00:00
The `spaceless` filter implicitly marks its output as safe
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-20 08:00:00
Sandbox does not protect against resource exhaustion
FriendsOfPHP

twig/twig

>=3.0.0, <3.26.0 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2026-05-20 08:00:00
Possible sandbox bypass when using a source policy
FriendsOfPHP

twig/twig

>=3.9.0, <3.26.0 · >=2.16.0, <3.0.0

2026-05-20 08:00:00
HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
FriendsOfPHP

twig/markdown-extra

>=3.0.0, <3.26.0 · >=2.12.0, <3.0.0

2026-05-20 08:00:00
Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
FriendsOfPHP

twig/intl-extra

>=3.0.0, <3.26.0 · >=2.12.0, <3.0.0

2026-05-20 08:00:00
HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
FriendsOfPHP

twig/cssinliner-extra

>=3.0.0, <3.26.0 · >=2.12.0, <3.0.0

2026-05-20 08:00:00
CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
FriendsOfPHP

symfony/yaml

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=5.4.0, <5.4.52 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-20 08:00:00
CVE-2026-45304: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
FriendsOfPHP

symfony/yaml

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=5.4.0, <5.4.52 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-20 08:00:00
CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings
FriendsOfPHP

symfony/yaml

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=5.4.0, <5.4.52 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-20 08:00:00
CVE-2026-45072: Stored XSS in WebProfiler CodeExtension::fileExcerpt(): Unescaped Non-PHP File Rendering
FriendsOfPHP

symfony/web-profiler-bundle

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=7.3.0, <7.4.0 · >=7.2.9, <7.3.0

2026-05-20 08:00:00
CVE-2026-47212: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection
FriendsOfPHP

symfony/twilio-notifier

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2026-05-20 08:00:00
CVE-2026-45072: Stored XSS in WebProfiler CodeExtension::fileExcerpt(): Unescaped Non-PHP File Rendering
FriendsOfPHP

symfony/twig-bridge

>=6.4.24, <6.4.40

2026-05-20 08:00:00
CVE-2026-47212: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2026-05-20 08:00:00
CVE-2026-46626: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
FriendsOfPHP

symfony/symfony

>=6.4.14, <6.4.40 · >=5.4.46, <5.4.52 · >=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.7, <7.2.0

2026-05-20 08:00:00
CVE-2026-45756: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=7.3.0, <7.4.0

2026-05-20 08:00:00
CVE-2026-45755: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0

2026-05-20 08:00:00
CVE-2026-45754: Mailjet Mailer and LOX24 Notifier Webhook Parsers Never Verify the Configured Secret: Unauthenticated Webhook Event Injection
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2026-05-20 08:00:00
CVE-2026-45753: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite: javascript: URI Survives Sanitization (XSS)
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0

2026-05-20 08:00:00
CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=5.4.0, <5.4.52 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-20 08:00:00
CVE-2026-45304: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=5.4.0, <5.4.52 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-20 08:00:00
CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings
FriendsOfPHP

symfony/symfony

>=8.0.0, <8.0.12 · >=7.4.0, <7.4.12 · >=6.4.0, <6.4.40 · >=5.4.0, <5.4.52 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2026-05-20 08:00:00
« Previous Next »

Showing 1 to 50 of 1459 results

1 2 3 4 5 6 7 8 9 10 ... 29 30