CVE-2026-121373 in Symfony
Summary
by MITRE • 11/04/2026
The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resulting in potential URL redirection to untrusted sites in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
The shared declarative refresh steps in the WHATWG HTML Standard require a broader approach: the separator after the time may be ASCII whitespace alone, with no ; or ,, and the url= keyword is optional. Directives the browser honours, but the regular expression misses are returned unchanged, so the attacker URL skips UrlSanitizer entirely and both allowLinkSchemes and allowLinkHosts are defeated for the refresh navigation.
This is reachable under any configuration that allows meta with http-equiv and content, including the documented allowStaticElements() preset.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The Symfony HtmlSanitizer component contains a critical logic flaw within its MetaRefreshAttributeSanitizer class, which was originally introduced to address CVE-2026-48761 but failed to fully mitigate the underlying risk due to an overly restrictive regular expression pattern. This vulnerability affects multiple branches of the Symfony framework, specifically versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The core issue stems from a discrepancy between how web browsers interpret HTML meta refresh directives according to the WHATWG HTML Standard and how the sanitizer validates them using its internal regular expression logic. This mismatch allows attackers to bypass security controls designed to prevent unauthorized URL redirections, leading to potential open redirect vulnerabilities that can be exploited for phishing attacks or session hijacking.
Under the shared declarative refresh steps defined in the WHATWG HTML Standard, the syntax for a meta refresh directive is more permissive than what Symfony's sanitizer currently enforces. Specifically, the standard dictates that the separator following the time delay value may consist of ASCII whitespace alone and does not strictly require semicolons or commas as separators. Furthermore, the url= keyword preceding the target URL is optional in certain valid configurations recognized by browsers. However, Symfony’s regular expression pattern fails to account for these variations, particularly those involving whitespace-only separation and missing explicit keywords. As a result, when an attacker crafts a meta tag with such non-standard but browser-compliant syntax, the sanitizer does not recognize it as a refresh directive requiring strict validation. Instead, it returns the content attribute unchanged, effectively skipping the UrlSanitizer component entirely.
This bypass mechanism defeats the security controls implemented through allowLinkSchemes and allowLinkHosts configurations. These settings are intended to restrict which URL schemes and hostnames are permitted in sanitized output, thereby preventing redirection to untrusted or malicious domains. Because the malformed directive escapes the sanitization pipeline due to the regex mismatch, the browser interprets it as a valid refresh instruction while Symfony’s security filters remain unaware of its presence. Consequently, users can be redirected to arbitrary external sites without triggering any warning or blocking mechanism within the application layer. This behavior undermines the integrity of content protection measures and exposes applications to cross-site scripting-adjacent attacks where trust in rendered HTML is exploited for malicious navigation.
The vulnerability is reachable under a wide range of configurations that permit meta tags with http-equiv attributes set to refresh, including those using the documented allowStaticElements() preset. This means that even applications relying on default or simplified sanitization presets are vulnerable if they process user-supplied content containing such meta tags. The impact extends beyond simple redirections; attackers can leverage this flaw to conduct phishing campaigns by directing victims to spoofed login pages, exfiltrate session tokens via referrer headers in subsequent requests, or trigger unintended actions within single-page applications that rely on client-side routing influenced by URL changes. In environments where sensitive data is transmitted over HTTP during redirects, additional risks such as credential interception arise.
To mitigate this vulnerability, organizations running affected Symfony versions must upgrade to the patched releases immediately: 6.4.50 or later for the 6.x branch, 7.4.23 or later for the 7.x branch, and 8.1.11 or later for the 8.x branch. These updates include corrected regular expressions that align with the WHATWG HTML Standard’s interpretation of meta refresh directives, ensuring all valid browser behaviors are properly sanitized. Until upgrades can be performed, administrators should consider implementing additional input validation layers at the application level to detect and reject malformed meta tags containing whitespace-separated URLs or missing url= prefixes. Deploying Web Application Firewalls configured to block suspicious redirect patterns may also provide temporary protection against exploitation attempts in production environments.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to correctly validate and sanitize user-supplied input according to expected standards. It also relates to CWE-697 Incorrect Comparison, since the regular expression logic does not accurately match all valid forms of meta refresh syntax recognized by browsers. In terms of attack vectors, this flaw supports techniques associated with ATT&CK T1189 Drive-by Client Side Redirects and potentially T1059 Command and Scripting Interpreter if combined with other injection flaws to execute further malicious actions after redirection. Security teams should prioritize patching these systems due to the ease of exploitation and the high likelihood of automated scanning tools targeting known Symfony vulnerabilities for opportunistic attacks against exposed web applications.