# CVE-2026-123339: Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request

Status: published. Published: 2026-11-06. Updated: 2026-11-06.

Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows a remote attacker to control the host, scheme, and port of absolute URLs generated for the rest of the request, poisoning links in pages stored by a shared cache and in e-mails sent after the page was rendered.When a page renders an inline fragment (render() in Twig, or an ESI tag rendered inline), SubRequestHandler temporarily adds 127.0.0.1 to the trusted proxies, and RouterListener rebuilds the router context from the main request while that trust is still active, so the X-Forwarded-* and Forwarded headers of a request whose client address is 127.0.0.1 are trusted even though that address is not a configured trusted proxy. From that point on, every absolute URL the router generates for the rest of the main request takes its host, scheme, and port from headers sent by the client, including URLs produced by url() in Twig and by UrlGeneratorInterface::ABSOLUTE_URL.

Applications are affected when they are reached over HTTP from 127.0.0.1, for example behind a TLS terminator, reverse proxy, local HTTP cache, or sidecar proxy on the same host, and that proxy passes the client’s forwarded headers along. With the default configuration (framework.trusted_proxies unset), all forwarded headers, including X-Forwarded-Host, are trusted during that window. Applications served through php-fpm, mod_php, or a proxy on another host are not affected. When framework.trusted_hosts is configured, a forwarded host outside the list is rejected, but the scheme and port can still be changed.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: Checkmarx) — https://github.com/symfony/symfony/commit/4b4e683b2c280083c6758bb776af952076add612

## Affected products and versions

- sensiolabs / symfony (symfony/http-kernel): ≥ 0; < 5.4.56 (affected, git); ≥ 6.0.0; < 6.4.50 (affected, git); ≥ 7.0.0; < 7.4.23 (affected, git); ≥ 8.0.0; < 8.1.11 (affected, git). Source: CNA: Checkmarx

## Severity and prioritization

- CVSS 4.0: 2.3 (low); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N; source: CNA: Checkmarx

- CVSS 4.0: 2.3 (low); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: 596c5446-0ce5-4ba2-aa66-48b3b757a647

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-348

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/symfony/symfony/security/advisories/GHSA-wg5q-m2ww-f3c9 (CNA: Checkmarx; third-party-advisory)

- https://github.com/symfony/symfony/commit/4b4e683b2c280083c6758bb776af952076add612 (CNA: Checkmarx; patch)

- https://github.com/symfony/symfony/commit/4b4e683b2c280083c6758bb776af952076add612 (596c5446-0ce5-4ba2-aa66-48b3b757a647)

- https://github.com/symfony/symfony/security/advisories/GHSA-wg5q-m2ww-f3c9 (596c5446-0ce5-4ba2-aa66-48b3b757a647)

## Provenance

- CNA: Checkmarx: https://www.cve.org/CVERecord?id=CVE-2026-123339; retrieved 2026-11-06; source updated 2026-11-06

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123339; retrieved 2026-11-07; source updated 2026-11-06

Revision: 535c65698024486b816f587e0a53e729ba37e258bc0dbfb58cc5aaf6402aacd7

Canonical: https://y2.dev/cve/CVE-2026-123339

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.