AIKIDO-2026-10959
symfony/routing is vulnerable to Open Redirect
61
Medium Risk
This Affects:
symfony/routingTL;DR
The UrlGenerator percent-encodes . and .. path segments so generated URLs remain on the originating route after RFC 3986 dot-segment normalization. The pre-fix strtr() logic skipped every other chained ./ or ../ segment, leaving some dot-segments unescaped. When a route parameter uses a permissive requirement such as .+ or .*, attacker-controlled chained dot segments can produce a URL that strict RFC-3986 consumers normalize to a different path than the route that generated it. The fix encodes every dot-segment in a single left-to-right pass.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/routing is vulnerable to Open Redirect in versions 0.0.1 - 5.4.52, 6.0.0 - 6.4.40, 7.0.0 - 7.4.12 and 8.0.0 - 8.0.12.
How to fix this
Upgrade the symfony/routing and/or the symfony/symfony library to the patch version.
Links
GitHub Releases
github.com/symfony/routing/releases/tag/v6.4.41github.com/symfony/symfony/releases/tag/v5.4.53github.com/symfony/symfony/releases/tag/v6.4.41github.com/symfony/symfony/releases/tag/v7.4.13
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.