CVE-2026-118517 | Sensiolabs Symfony up to 6.4.49/7.4.22/8.1.10 UrlSanitizer allowLinkHosts/allowMediaHosts input validation

November 5, 2026 Yanac

A vulnerability marked as critical has been reported in Sensiolabs Symfony up to 6.4.49/7.4.22/8.1.10. This vulnerability affects the function allowLinkHosts/allowMediaHosts of the component UrlSanitizer. This manipulation causes improper input validation.

This vulnerability appears as CVE-2026-118517. The attack may be initiated remotely. There is no available exploit.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More