Symfony has fixed a routing flaw that can let a request reach a protected controller without triggering the path-based rules intended to guard it. For affected deployments, installing the update is only part of the repair: Symfony says the application cache must also be cleared to replace vulnerable compiled routes.
The project disclosed CVE-2026-118516 on November 4. Exposure depends on an application combining routes with variable hostnames and security rules based on the request path. It is not a claim that every Symfony application permits unauthenticated access.
Where routing and security disagree
A host placeholder is the variable part of a route’s hostname. The vulnerable compiled matcher processes the hostname and path together. A placeholder can consume a slash and part of the path, producing a route match that the separate host-and-path matcher would reject. Meanwhile, security rules evaluate the actual path and may not recognise it as belonging to the protected area.
Symfony’s advisory distinguishes two configurations. With the default placeholder requirement, trusted-host validation can block the shortened hostname involved. If a custom requirement accepts slashes, such as .+, an ordinary hostname can work and trusted_hosts does not prevent the bypass. Administrators should therefore assess the route requirements as well as their accepted hostnames.
The maintainer’s GitHub advisory rates the issue Moderate, with a CVSS v4.0 score of 6.3. It lists fixes for both the standalone symfony/routing package and the full symfony/symfony package: 5.4.56, 6.4.50, 7.4.23 and 8.1.11. The affected ranges are versions before 5.4.56; 6.x before 6.4.50; 7.x before 7.4.23; and 8.x before 8.1.11.
Treat the cache rebuild as part of deployment
The published patch changes the compiled-route generator to preserve the boundary between hostname and path. Its regression tests cover ordinary placeholders, permissive requirements, named groups and static routes, checking that malformed combinations are rejected while valid routing still works. These are the project’s tests; DaySec has not independently executed them.
For teams maintaining affected applications, the deployment checklist should connect three checks: the resolved package version, regeneration of compiled routes, and verification that protected controllers still enforce the intended access rules. Checking a dependency file alone cannot establish that the running application has discarded its old route cache.
The vendor and GitHub advisories reviewed for this report do not state that exploitation has been observed in the wild. That limits what can be said about attacker activity; the documented configuration-dependent bypass remains a reason to apply the fixes.
