Packagist/symfony/html-sanitizer CVE-2026-48761: medium, EPSS 0.34%

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes

Action: Upgrade symfony/html-sanitizer to 6.4.41 or later.

composer require symfony/html-sanitizer:6.4.41

composer require symfony/html-sanitizer:7.4.13

composer require symfony/html-sanitizer:8.0.13

Affected

Fixed versions

Sources

• osv: GHSA-x5qj-865h-mgvm
• https://github.com/symfony/symfony/security/advisories/GHSA-x5qj-865h-mgvm
• https://github.com/symfony/symfony/commit/069a70f9f26e61e9de3b7f9a864a86ed24b36bd0
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/html-sanitizer/CVE-2026-48761.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48761.yaml
• https://github.com/symfony/symfony
• https://symfony.com/cve-2026-48761

CVE-2026-48761 · published 2026-06-15T16:46:53Z · modified 2026-09-10T03:50:51.216603592Z · JSON