sensiolabs vulnerabilities

Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true

sensiolabs · symfony

Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects

sensiolabs · symfony

Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File

sensiolabs · symfony

Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File

sensiolabs · symfony

Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process

sensiolabs · symfony

Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request

sensiolabs · symfony

Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers

sensiolabs · symfony

Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass

sensiolabs · symfony

Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)

sensiolabs · symfony

Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass

sensiolabs · symfony