Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request

Summary

CVE	CVE-2026-123339
State	PUBLISHED
Assigner	Checkmarx
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-11-06 15:17:17 UTC
Updated	2026-11-06 15:17:17 UTC
Description	Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows a remote attacker to control the host, scheme, and port of absolute URLs generated for the rest of the request, poisoning links in pages stored by a shared cache and in e-mails sent after the page was rendered.When a page renders an inline fragment (render() in Twig, or an ESI tag rendered inline), SubRequestHandler temporarily adds 127.0.0.1 to the trusted proxies, and RouterListener rebuilds the router context from the main request while that trust is still active, so the X-Forwarded-* and Forwarded headers of a request whose client address is 127.0.0.1 are trusted even though that address is not a configured trusted proxy. From that point on, every absolute URL the router generates for the rest of the main request takes its host, scheme, and port from headers sent by the client, including URLs produced by url() in Twig and by UrlGeneratorInterface::ABSOLUTE_URL. Applications are affected when they are reached over HTTP from 127.0.0.1, for example behind a TLS terminator, reverse proxy, local HTTP cache, or sidecar proxy on the same host, and that proxy passes the client’s forwarded headers along. With the default configuration (framework.trusted_proxies unset), all forwarded headers, including X-Forwarded-Host, are trusted during that window. Applications served through php-fpm, mod_php, or a proxy on another host are not affected. When framework.trusted_hosts is configured, a forwarded host outside the list is rejected, but the scheme and port can still be changed.

Risk And Classification

Primary CVSS: v4.0 2.3 LOW from 596c5446-0ce5-4ba2-aa66-48b3b757a647

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Problem Types: CWE-348 | CWE-348 CWE-348 Use of Less Trusted Source

Version	Source	Type	Score	Severity	Vector
4.0	596c5446-0ce5-4ba2-aa66-48b3b757a647	Secondary	2.3	LOW	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/C...`
4.0	CNA	CVSS	2.3	LOW	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N`

CVSS v4.0 Breakdown

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

Passive

Confidentiality

None

Integrity

Low

Availability

None

Sub Conf.

Low

Sub Integrity

None

Sub Availability

None

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Sensiolabs	Symfony	affected 5.4.56 git	Not specified
CNA	Sensiolabs	Symfony	affected 6.0.0 6.4.50 git	Not specified
CNA	Sensiolabs	Symfony	affected 7.0.0 7.4.23 git	Not specified
CNA	Sensiolabs	Symfony	affected 8.0.0 8.1.11 git	Not specified

References

Reference	Source	Link	Tags
github.com/symfony/symfony/commit/4b4e683b2c280083c6758bb776af952076add612	596c5446-0ce5-4ba2-aa66-48b3b757a647	github.com
github.com/symfony/symfony/security/advisories/GHSA-wg5q-m2ww-f3c9	596c5446-0ce5-4ba2-aa66-48b3b757a647	github.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Nicolas Grekas (en)

There are currently no legacy QID mappings associated with this CVE.