Description

The Symfony HtmlSanitizer component does not apply the media URL policy to the srcset and imagesrcset attributes, allowing values that point to hosts or schemes not permitted by allowMediaSchemes() or allowMediaHosts() to bypass it, so that browsers load images from disallowed hosts in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.The srcset attribute on img and source elements and the imagesrcset attribute on link elements are allowed by the sanitizer, but their URL candidates are never validated, so their values are kept verbatim while the same URL in src is dropped. The fixes for CVE-2026-45753 and CVE-2026-48761 extended the same attribute list but did not cover these two attributes. For example, with allowMediaSchemes(['https']) and allowMediaHosts(['trusted.example']), <img srcset="https://evil.example/a.png 1x"> survives sanitization, and the browser fetches the selected candidate as it would fetch src. Candidates with a scheme forbidden by the configuration, such as http, are kept as well. Any application that sanitizes untrusted HTML and relies on the media schemes and hosts allowlists to restrict where images can be loaded from is affected. A single crafted value is enough to make the browser of a user viewing the sanitized content send a request to an attacker-controlled host, which can be used to track viewers or log their IP addresses. No authentication is needed if the application accepts HTML from unauthenticated users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-05T18:17:07.480Z",
  "pubdate": "2026-11-05T18:17:07.480Z",
  "executiveSummary": "The Symfony HtmlSanitizer component is susceptible to a security bypass vulnerability involving the 'srcset' and 'imagesrcset' HTML attributes. This flaw allows attackers to circumvent configured media URL policies, specifically 'allowMediaSchemes()' and 'allowMediaHosts()'.\nThe vulnerability occurs because the sanitizer fails to perform necessary validation on URL candidates embedded within the 'srcset' and 'imagesrcset' attributes of 'img', 'source', and 'link' elements, despite properly filtering the 'src' attribute. Consequently, the component preserves malicious or disallowed external URLs that would otherwise be rejected.\nThis flaw impacts applications utilizing the Symfony HtmlSanitizer to process untrusted HTML, effectively nullifying security controls designed to restrict asset loading. An attacker can exploit this to force a victim's browser to send requests to arbitrary, attacker-controlled hosts.\nThe primary risk implications include potential user tracking, IP address logging, and exfiltration of information via browser requests. No authentication is required for exploitation if the application accepts input from unauthenticated users, making this a significant risk for platforms that allow user-generated content.\nThe issue persists across Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11, as previous fixes for CVE-2026-45753 and CVE-2026-48761 failed to extend validation to these specific attributes.",
  "technicalDetails": "The root cause of this vulnerability lies in an incomplete implementation of the HTML sanitization logic within the Symfony HtmlSanitizer component. While the component correctly maintains allowlists for media schemes (e.g., https) and hostnames (e.g., trusted.example) for primary 'src' attributes, it fails to apply these same rigorous checks to the 'srcset' attribute (on 'img' and 'source' tags) and the 'imagesrcset' attribute (on 'link' tags).\nIn standard browser behavior, 'srcset' allows multiple image candidates to be defined. The sanitizer's internal logic processes these elements but fails to parse or validate the individual URL components within the attribute string. Instead, the component preserves the 'srcset' attribute values verbatim. This creates a functional parity gap: while the 'src' attribute is correctly sanitized, the 'srcset' attribute acts as an bypass mechanism.\nAn attacker can craft an HTML payload such as '<img srcset=\"https://evil.example/a.png 1x\">'. When a user views this sanitized HTML, the browser identifies the 'srcset' attribute and proactively initiates a network request to the specified 'evil.example' host to fetch the image, regardless of whether 'evil.example' is present in the application's 'allowMediaHosts()' list.\nThe attack flow is straightforward: 1) The attacker submits malicious HTML content containing 'srcset' or 'imagesrcset' attributes pointing to an attacker-controlled endpoint. 2) The application passes this string through the Symfony HtmlSanitizer. 3) The sanitizer fails to validate the URLs within 'srcset', resulting in the malicious attribute being rendered in the final output. 4) The victim's browser, upon rendering the HTML, automatically fetches the external resource. 5) The attacker logs the incoming request, thereby obtaining the victim's IP address and potentially other identifying metadata associated with the request headers.\nThis vulnerability is particularly concerning as it remains effective even when developers have explicitly configured strict URL policies. Because the component previously received updates for related vulnerabilities (CVE-2026-45753 and CVE-2026-48761), the failure to incorporate 'srcset' and 'imagesrcset' into the sanitization logic suggests a gap in coverage during the regression testing or patching phase for those specific CVEs.\nThis flaw is exploitable without authentication, assuming the application accepts HTML input from external sources. It requires no specific privileges and functions across any network configuration where the client can reach both the application and the attacker's server."
}