{"id":"DEBIAN-CVE-2026-48784","details":"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters to generate URLs that collapse to a different path under RFC 3986 normalization. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.","modified":"2026-09-14T17:03:16.012431860Z","published":"2026-07-14T20:17:10.517Z","upstream":["CVE-2026-48784"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-48784"}],"affected":[{"package":{"name":"symfony","ecosystem":"Debian:12","purl":"pkg:deb/debian/symfony?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.53+dfsg-0+deb12u1"}]}],"versions":["5.4.23+dfsg-1","5.4.23+dfsg-1+deb12u1","5.4.23+dfsg-1+deb12u2","5.4.23+dfsg-1+deb12u3","5.4.23+dfsg-1+deb12u4","5.4.23+dfsg-1+deb12u5","5.4.24+dfsg-1","5.4.25+dfsg-1","5.4.27+dfsg-1","5.4.28+dfsg-1","5.4.29+dfsg-1","5.4.30+dfsg-1","5.4.31+dfsg-1","5.4.31+dfsg-2","5.4.32+dfsg-1","5.4.33+dfsg-1","5.4.34+dfsg-1","5.4.34+dfsg-2","5.4.35+dfsg-1","5.4.35+dfsg-2","5.4.35+dfsg-3","5.4.52+dfsg-0+deb12u1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48784.json"}},{"package":{"name":"symfony","ecosystem":"Debian:13","purl":"pkg:deb/debian/symfony?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.41+dfsg-0+deb13u1"}]}],"versions":["6.4.21+dfsg-2","6.4.21+dfsg-2+deb13u1","6.4.24+dfsg-1","6.4.25+dfsg-1","6.4.40+dfsg-0+deb13u1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48784.json"}},{"package":{"name":"symfony","ecosystem":"Debian:14","purl":"pkg:deb/debian/symfony?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.13+dfsg-1"}]}],"versions":["6.4.21+dfsg-2","6.4.24+dfsg-1","6.4.25+dfsg-1","7.0.4+dfsg-1","7.0.5+dfsg-1","7.0.6+dfsg-1","7.0.7+dfsg-1","7.1.0~beta1+dfsg-1","7.1.0~rc1+dfsg-1","7.1.2+dfsg-1","7.1.3+dfsg-1","7.1.4+dfsg-1","7.1.5+dfsg-1","7.2.0~beta1+dfsg-1","7.2.0~beta2+dfsg-1","7.2.0~rc1+dfsg-1","7.2.1+dfsg-1","7.2.2+dfsg-1","7.2.3+dfsg-1","7.2.4+dfsg-1","7.2.5+dfsg-1","7.2.6-1","7.3.0+dfsg-1","7.3.0~beta1+dfsg-1","7.3.0~beta2+dfsg-1","7.3.0~rc1+dfsg-1","7.3.1+dfsg-1","7.3.2+dfsg-1","7.3.3+dfsg-1","7.3.4+dfsg-1","7.3.5-1","7.4.0+dfsg-1","7.4.0+dfsg-2","7.4.0~beta1-1","7.4.0~beta1-2","7.4.0~beta2+dfsg-1","7.4.0~beta2+dfsg-2","7.4.0~beta2+dfsg-3","7.4.0~rc1+dfsg-1","7.4.0~rc2+dfsg-1","7.4.0~rc3+dfsg-1","7.4.10+dfsg-1","7.4.12+dfsg-1","7.4.2+dfsg-1","7.4.2+dfsg-2","7.4.3+dfsg-1","7.4.4+dfsg-1","7.4.5+dfsg-1","7.4.6+dfsg-1","7.4.6+dfsg-2","7.4.7+dfsg-1","7.4.8+dfsg-1","7.4.9+dfsg-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48784.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}