AIKIDO-2026-623911

symfony/symfony is vulnerable to Open Redirect

GHSA-5MX8-MWRP-5693Published 4 days ago

CVE Score

Medium

Open Redirect

TL;DR

Before the fix, getBaseUrl() matched the client-supplied request URI against the script-derived base URL without rejecting URIs that start with // or /\, so anyone who gets a user to open a crafted link such as https://app.example//evil.example/public/index.php/login made the base URL begin with a host they chose. URLs built with getUriForPath() and getUri() then pointed there, sending form actions, redirects and asset URLs to that host, including login credentials. This matters when the front controller sits in a subdirectory and the web server rewrites every URL to it, or when the server sets SCRIPT_NAME to the request path. The fix returns an empty base URL whenever the request URI starts with // or /\.

How do I fix this?

Upgrade the symfony/symfony package to a fixed release on your branch: 5.4.56, 6.4.50, 7.4.23, 8.1.11.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and serve the app from a subdirectory front controller with URL rewriting, or with SCRIPT_NAME set to the request path, reachable by unauthenticated clients.