CVE-2026-45070mediumCWE-93

CVE-2026-45070: falha de média gravidade em symfony

Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar symfony+ Monitorar mime

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.4%
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Mime\Header\ParameterizedHeader validates and encodes parameter values but emits parameter names verbatim, allowing a caller that derives a parameter name from untrusted input to include CRLF or other non-token bytes and inject additional headers into rendered structured mail headers such as Content-Type or Content-Disposition. This issue is reported as fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
symfony · mimesymfony · symfony
CVEs relacionadas — symfony

No mesmo produto, das mais perigosas para as menos.

CVE-2024-50340HIGHAbility to change environment from query in symfony/runtimeEPSS 61.8%CVE-2022-24894MEDIUMSymfony storing cookie headers in HttpCacheEPSS 4.0%CVE-2020-15094HIGHRCE in SymfonyEPSS 3.0%CVE-2021-21424MEDIUMPrevent user enumeration using Guard or the new Authenticator-based SecurityEPSS 1.6%CVE-2026-47212MEDIUMSymfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event InjectionEPSS 1.5%CVE-2025-64500HIGHSymfony's incorrect parsing of PATH_INFO can lead to limited authorization bypassEPSS 1.4%