Nixpkgs security tracker

Untriaged

Permalink CVE-2026-48784

5.1 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 day, 16 hours ago Activity log

Created suggestion 1 day, 16 hours ago

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters to generate URLs that collapse to a different path under RFC 3986 normalization. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

References

https://github.com/symfony/symfony/security/advisories/GHSA-h5x3-xfc9-m39h x_refsource_CONFIRM
https://github.com/symfony/symfony/commit/4b63c3a3f7af04ecd79c89a594b0b02a01990b1d x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v5.4.53 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v6.4.41 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v7.4.13 x_refsource_MISC

Affected products

routing

==>= 6.0.0-BETA1, < 6.4.41
==< 5.4.53
==>= 7.0.0-BETA1, < 7.4.13
==>= 8.0.0-BETA1, < 8.0.13

symfony

==>= 7.0.0-BETA1, < 7.4.13
==>= 6.0.0-BETA1, < 6.4.41
==< 5.4.53
==>= 8.0.0-BETA1, < 8.0.13

Matching in nixpkgs

pkgs.freerouting

Advanced PCB auto-router

nixos-unstable 2.2.4
- nixpkgs-unstable 2.2.4
- nixos-unstable-small 2.2.4
nixos-26.05 2.2.4
- nixos-26.05-small 2.2.4
- nixpkgs-26.05-darwin 2.2.4

pkgs.symfony-cli

Symfony CLI

nixos-unstable 5.17.1
- nixpkgs-unstable 5.17.1
- nixos-unstable-small 5.17.1
nixos-26.05 5.17.1
- nixos-26.05-small 5.17.1
- nixpkgs-26.05-darwin 5.17.1

pkgs.kodiPackages.routing

Routing module for kodi plugins

nixos-unstable 0.2.3+matrix.1
- nixpkgs-unstable 0.2.3+matrix.1
- nixos-unstable-small 0.2.3+matrix.1
nixos-26.05 0.2.3+matrix.1
- nixos-26.05-small 0.2.3+matrix.1
- nixpkgs-26.05-darwin 0.2.3+matrix.1