Symfony Routing CVE-2026-45065

Exploitation requires three concurrent conditions: (1) at least one route in the application defines a parameter requirement as a regex alternation with three or more alternatives where at least one middle alternative appears as a substring of a crafted attacker value (e.g., vi within /evil.com); (2) the application passes an externally influenced parameter value - from user input, query string, API payload, or similar - to UrlGenerator via path()/url() Twig helpers or direct generator calls without prior sanitization or allowlisting; and (3) the generated URL is subsequently rendered in a template response or used as an HTTP redirect target that a user will follow. Exploitation is limited by: two-alternative requirements are not vulnerable because both alternatives are anchored; the strictRequirements setting must be non-null (if explicitly set to null/disabled, validation is skipped entirely and a different, more permissive code path is used); and the application architecture must actually use UrlGenerator output as a navigable URL rather than purely for internal routing. Authentication requirements are not confirmed from available data, as no CVSS vector is provided.

No CVSS vector or EPSS score is available for this CVE, precluding quantitative risk ranking from standard scoring signals. The impact classification in advisory metadata is 'Information Disclosure,' though the actual attack outcome - open redirect enabling phishing, credential harvesting, or session token theft via protocol-relative URL injection - more accurately constitutes an integrity and availability risk to end users. The vulnerability is not listed in CISA KEV, and no public exploit code is identified at time of analysis. The realistic attack surface is significant: the trigger pattern (multi-value alternation in route requirements) is extremely common in internationalized Symfony applications using _locale parameters, and the advisory covers every currently supported Symfony branch (5.4.x, 6.x, 7.x, 8.x). Exploitation requires the application to pass externally influenced values to UrlGenerator and render or redirect using the output, which is a non-default but architecturally common pattern. Despite the absence of active exploitation signals, the breadth of the affected version range, clarity of the attack mechanism from the public advisory, and prevalence of the trigger configuration make this a real patching priority for i18n-enabled Symfony deployments.

An attacker targeting an internationalized Symfony application identifies a route such as /{_locale}/blog with a _locale requirement of en|fr|vi|de. By supplying the parameter value /evil.com - which contains vi as a substring and satisfies the unanchored middle-alternative regex - the attacker causes UrlGenerator to generate the URL //evil.com/blog. When this URL is rendered in a Twig template via path() or used in an HTTP redirect response, the browser interprets //evil.com as a protocol-relative URL and navigates to the attacker-controlled domain, enabling a phishing page or credential-harvesting attack against the application's users. No public exploit code is identified at time of analysis, but the attack is mechanically straightforward given the fully detailed public advisory and patch diff.