Symfony HtmlSanitizer Component URL Parsing Vulnerability

CVE-2026-118517

What is CVE-2026-118517?

The UrlSanitizer in Symfony's HtmlSanitizer component processes URLs differently than major web browsers, which leads to potential security issues. Specifically, it allows the bypassing of allowLinkHosts() and allowMediaHosts() checks for URLs lacking a well-formed authority. For instance, malformed URLs like 'http:evil.example' or 'https://://evil.example/' might not be recognized as having a host by the sanitizer, unlike browsers that resolve them correctly. As a result, untrusted hosts can be referenced in sanitized outputs when combined with allowRelativeLinks(true) or allowRelativeMedias(true). While the default configuration remains secure, awareness of this vulnerability is crucial for developers using affected Symfony versions.

References