Symfony Routing CVE-2026-48784

Two specific non-default conditions must both be present for exploitation to be possible. First, at least one Symfony route must define a path parameter with a permissive requirement that explicitly allows forward slashes - for example, ['path' => '.+'] or ['path' => '.*'] in the route definition. Default Symfony route parameters use [^/]+ and are therefore not exploitable regardless of input. Second, a strict RFC 3986-conformant consumer must process the generated URL downstream of Symfony: this includes reverse proxies (nginx with merge_slashes-class normalization, Varnish, HAProxy in strict mode), API gateways, or HTTP client libraries that perform dot-segment removal before percent-decoding. WHATWG-conformant browsers are explicitly excluded from the defense model and do not trigger this path. Exploitation is further limited to chained sequences of two or more consecutive ../ or ./ segments; a single ../ or ./ was correctly encoded by the original strtr implementation and remains safe.

No CVSS score has been assigned by NVD or the vendor at time of analysis, so risk signals must be derived from structural and contextual evidence. The vulnerability is not present in CISA KEV, no EPSS score is available, and no public proof-of-concept has been identified - exploitation likelihood appears low at this time. The attack surface is narrow: both a non-default permissive route parameter requirement (.+, .*) and an RFC 3986-conformant downstream consumer must be present simultaneously; neither condition exists in a baseline Symfony deployment. The 'Information Disclosure' tag and CWE-172 classification indicate the impact ceiling is path traversal to unintended resources, not code execution. The existence of a prior related vulnerability (CVE-2026-45065) in the same code path suggests the encoding logic was under-tested for chained sequences and systemic review was warranted. Patch availability across all maintained branches (5.4, 6.4, 7.4, 8.0, 8.1) lowers residual risk significantly for patched deployments. Applications not exposing slash-accepting route parameters are not affected regardless of patch status.

An attacker identifies a Symfony application with a route such as /files/{path} where the path parameter uses a .+ requirement permitting slashes, and submits a request with a path value of ../../... The UrlGenerator produces /files/%2E%2E/../%2E%2E instead of the correct /files/%2E%2E/%2E%2E/%2E%2E. When this URL is forwarded by a reverse proxy performing RFC 3986 dot-segment normalization, it resolves to / or another unintended base path, potentially exposing resources that the routing layer was intended to protect. No public proof-of-concept code has been identified at time of analysis.