Server-Side Request Forgery Vulnerability in Symfony Validator Component by Symfony
CVE-2026-123125

6.3MEDIUM

Key Information:

Vendor

Sensiolabs

Status
Symfony
Vendor
CVE Published:
5 November 2026

What is CVE-2026-123125?

The IpValidator component in Symfony incorrectly classifies certain internal addresses when using filtered modes of the Ip constraint. This vulnerability arises from the reliance on PHP flags that do not adequately cover specific address spaces, allowing potentially unsafe internal addresses to be recognized as valid public addresses. As a result, applications that employ this validator for address validation prior to executing server-side requests could be susceptible to Server-Side Request Forgery attacks, thereby exposing sensitive infrastructure and data to malicious actors.

Affected Version(s)

symfony 0 < 5.4.56

symfony 6.0.0 < 6.4.50

symfony 7.0.0 < 7.4.23

References

https://github.com/symfony/symfony/security/advisories/GH...
third-party-advisory
https://github.com/symfony/symfony/commit/3bf8ea37fcb402c...
patch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zx (Jace)
Nicolas Grekas
.