CVE-2026-118517
Description
A flaw was found in the Symfony HtmlSanitizer component. Due to differences in how URLs are parsed compared to web browsers, the component fails to properly detect hosts in certain malformed URLs when host allowlists are enforced. A remote attacker can exploit this vulnerability by submitting specially crafted URLs to bypass host validation, resulting in untrusted links or media being retained in sanitized output.
Statement
This vulnerability is rated as Moderate impact because successful exploitation requires non-default configuration and user interaction, limiting the blast radius to partial integrity loss without compromising system availability or data confidentiality. Under standard configurations, HtmlSanitizer does not permit relative paths alongside host filtering, leaving default deployments unaffected. Exposure is confined to custom implementations that explicitly enable relative links or media alongside host allowlists, enabling malformed URIs to evade host-matching controls when interpreted by client web browsers.
Mitigation
To mitigate this issue, avoid combining host allowlists with relative link or relative media permissions in the HtmlSanitizer configuration. Ensure that `allowRelativeLinks` and `allowRelativeMedias` remain disabled (set to `false`), which is the default configuration.
Caveat: Disabling relative links or media causes relative paths to be stripped or rejected in sanitized content, which may impact applications relying on relative URLs. Applying configuration changes to the application environment may require restarting the web server or PHP-FPM service.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context; Bypass Protection Mechanism
Attackers can sometimes bypass input validation schemes by finding inputs that appear to be safe, but will be dangerous when processed at a lower layer or by a downstream component. For example, a simple XSS protection mechanism might try to validate that an input has no "<script>" tags using case-sensitive matching (CWE-178), but since HTML is case-insensitive when processed by web browsers, an attacker could inject "<ScrIpT>" and trigger XSS (CWE-79).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
