AIKIDO-2026-109712

sylius/sylius is vulnerable to Host Header Injection

Host Header InjectionGHSA-77w3-2367-7xvq Published 4 days ago

High Risk

This Affects:

sylius/sylius

1.12.0 - 1.12.24

Fixed in 1.12.25

1.13.0 - 1.13.16

Fixed in 1.13.17

1.14.0 - 1.14.19

Fixed in 1.14.20

2.0.0 - 2.1.15

Fixed in 2.1.16

2.2.0 - 2.2.8

Fixed in 2.2.9

Are you affected? Scan for Free

TL;DR

The administrator password-reset email builds the absolute reset link with Twig's url() helper, which derives the scheme and host from the incoming request. Because Sylius ships no framework.trusted_hosts configuration, the Host header of the unauthenticated reset request controls the domain in the generated link. Anyone who can trigger a reset email for an administrator can point the reset link at a domain they control and capture the reset token when the link is followed, taking over the account. The fix builds the reset URL from the channel's configured hostname stored in the database instead of from the request.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you have not configured framework.trusted_hosts.

Background info

sylius/sylius is vulnerable to Host Header Injection in versions 1.12.0 - 1.12.24, 1.13.0 - 1.13.16, 1.14.0 - 1.14.19, 2.0.0 - 2.1.15 and 2.2.0 - 2.2.8.