Search: CVE-2026-48761

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.1	EPSS 0.3%	CVE-2026-48761Symfony · From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet> Medium6.1EPSS 0.3%2026-07-14GCVE DatabaseCVE-2026-48761 A vulnerability in the Symfony PHP framework versions from 6.1.0 up to but not including 6.4.41, 7.4.13, and 8.0.13 allows certain URL-bearing attributes on HTML elements such as <object>, <applet>, <iframe>, <img>, and <meta http-equiv="refresh"> to bypass URL sanitization. This can result in javascript: and similar payloads passing into sanitized output. The issue is fixed in Symfony versions 6.4.41, 7.4.13, and 8.0.13. EPSS 0.3%Vulnerability	GCVE Database	2026-07-14

Page 1 of 1