CVE-2026-48760
Is CVE-2026-48760 real, exploitable, or a false positive? Here's the community verdict.
signals
public sources
Moderate signals. Triage by your actual exposure and reachability.
baseline read
auto · not a community verdict
Officially disputed
The CVE record itself is disputed or rejected upstream — a strong candidate for a false positive in scanners. Confirm with a verdict.
Based on NVD record status
Confirm or dispute →CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse() rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs to retain visual-spoofing characters that downstream consumers could decode or display. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.
References
Published
Embed this verdict
[](https://www.truepositive.app/cve/CVE-2026-48760)<a href="https://www.truepositive.app/cve/CVE-2026-48760"><img src="https://www.truepositive.app/cve/CVE-2026-48760/badge.svg" alt="TruePositive verdict for CVE-2026-48760"></a>Live badge that updates automatically as the community verdict changes.
Community ground truth
Be the first practitioner to weigh in
So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.
🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.
In your experience, is this finding real and exploitable?
awaiting field verdictsCurated baseline: A curated baseline from public sources, shown separately from community verdicts.
No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.
Field notes & remediation
Verdicts are the quick signal. Notes are the evidence and fixes behind them.
- 0
No confirmed in-the-wild exploitation or public exploit was found for this yet.
Add a field note or remediationoptional
Related CVEs
Same weakness: CWE-451.
- CVE-2024-38112HIGH 7.5KEVEPSS 84%
Windows MSHTML Platform Spoofing Vulnerability
- CVE-2024-43461HIGH 8.8KEVEPSS 52%
Windows MSHTML Platform Spoofing Vulnerability
- CVE-2024-38082MED 4.7EPSS 0%
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2024-38093MED 4.3EPSS 0%
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-3861MED 6.5EPSS 0%
LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily inoperable.
- CVE-2026-45064MED 6.1EPSS 0%
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse() passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized content to display a link destination that visually differs from the actual destination and enabling phishing-style visual spoofing. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.