N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45066

CVE-2026-45066: Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

Description

symfony/html-sanitizer lets applications sanitise untrusted HTML. The configuration methods allowLinkHosts([...]) and allowLinkSchemes([...]) are intended to restrict <a href> targets to an allowlist of hosts/schemes; allowMediaHosts() / allowMediaSchemes() do the same for <img src> etc.

Three distinct bypasses allow a content author to smuggle off-allowlist URLs past these checks. First, UrlSanitizer::parse() parses the input following RFC-3986, while browsers follow the WHATWG URL Standard which normalises \ to / before parsing the authority of "special" schemes; so an input like https://evil\@trusted.com/ parses with host trusted.com server-side but navigates to https://evil/ in the browser. Second, WHATWG collapses any run of / after the scheme into //, while RFC-3986 does not; so https:/evil.com/ and https:///evil.com/ parse as host-less (skipping the host allowlist) but resolve to evil.com in the browser. Third, UrlAttributeSanitizer checks 'a' === $element to route to the link policy and falls through to the media policy otherwise, but <area> is a navigable hyperlink equivalent to <a>; so <area href> was sanitised against the media policy (which typically allows data: and may have no host allowlist), bypassing allowLinkHosts() / allowLinkSchemes() entirely.

Resolution

UrlSanitizer::sanitize() now rejects URLs that contain a backslash or that use a special scheme (http, https, ftp, ws, wss) followed by a single slash or three slashes before parsing, eliminating the parser-differential bypasses. now applies the link policy to both and elements.

Miggo Vulnerability Database

→

CVE-2026-45066

CVE-2026-45066:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
symfony/html-sanitizer	composer	>= 6.1.0, < 6.4.40	6.4.40
symfony/html-sanitizer	composer	>= 7.0.0, < 7.4.12	7.4.12
symfony/html-sanitizer

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the associated patch (d506b556d3d3906f3e8660ad82257ce87edbaac4) reveals two primary vulnerable functions that lead to three distinct bypasses of the HTML sanitizer's URL restrictions.

The root cause of the vulnerability lies in two areas:

URL Parser Differentials: The UrlSanitizer::sanitize function did not account for differences in how URLs are parsed by PHP's parse_url (following RFC 3986) and modern browsers (following the WHATWG URL Standard). Attackers could exploit this by using backslashes (\) instead of forward slashes (/) or by using an unusual number of slashes after the URL scheme. These malformed URLs would be misinterpreted by the sanitizer, leading it to extract an incorrect (and allowed) hostname, while the browser would correctly interpret the URL and navigate to a malicious, disallowed host.
Element Misclassification: The UrlAttributeSanitizer::sanitizeAttribute function failed to recognize that the <area> HTML element is a navigable hyperlink, similar to the <a> element. It only applied the strict link-related security policies (like allowLinkHosts) to <a> tags. Consequently, an href attribute within an <area> tag was sanitized using the more lenient media policy, allowing an attacker to bypass the restrictions intended for links.

The patch addresses these issues directly:

In UrlSanitizer.php, it adds a pre-emptive check to the sanitize method to reject any URL containing a backslash or specific slash combinations that are indicative of a parser differential attack.
In UrlAttributeSanitizer.php, it modifies the sanitizeAttribute method to ensure that both <a> and <area> elements are subjected to the same link sanitization policy.

Therefore, during exploitation, a runtime profile would show calls to Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer::sanitize when processing a malicious URL and when processing an tag with a malicious .

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-45066: Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

Description

Resolution

CVE-2026-45066:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

N/A

N/A

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

CVE-2026-45066: Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

Description

Resolution

Vulnerable functions

Credits

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-45066: Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

Description

Resolution

CVE-2026-45066:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

N/A

N/A

Basic Information

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

CVE-2026-45066: Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

Description

Resolution

Vulnerable functions

Credits

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI