Problem/Motivation

https://symfony.com/cve-2026-48784

Core has its own copy of the vulnerable logic in UrlGenerator:: generateFromRoute(). In addition to #3592421: Update Symfony routing and http-foundation versions we also need to fix our forked copy.

Steps to reproduce

Proposed resolution

Cherry-pick from Symfony commit 4b63c3a3 UrlGenerator

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

Issue fork drupal-3592341

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

znerol created an issue. See original summary.

znerol opened merge request !15890

znerol’s picture

znerol commented
Status: Active » Needs review
smustgrave’s picture

smustgrave commented

Should we add test coverage for this?

znerol’s picture

znerol commented

Right. Ported the tests over from the symfony commit as well.

smustgrave’s picture

smustgrave commented
Status: Needs review » Reviewed & tested by the community

Rock on, LGTM.

znerol’s picture

znerol commented

Would be good to run the Test-only changes pipeline as well. I seemingly do not have permissions to kick it off.

smustgrave’s picture

smustgrave commented

I also can't without starting a new pipeline but ran locally

Failed asserting that two strings are identical.
Expected :'/test-path/%2E%2E/%2E%2E/%2E%2E/bar'
Actual   :'/test-path/%2E%2E/../%2E%2E/bar'
dww’s picture

dww
we/he/they
commented
Priority: Normal » Major
Issue tags: +Bug Smash Initiative, +Security

Bumping to at least Major as this is from Symfony CVE-2026-48784

dww’s picture

dww
we/he/they
commented
Component: base system » routing system

I also reviewed the Symfony commit, the MR changes, test changes. Everything looks good. Bot is happy. Nothing to complain about. Let's get this in!

Thanks,
-Derek

dww’s picture

dww
we/he/they
commented
Issue summary: View changes

godotislate closed merge request !15890

  • godotislate committed 01058045 on main 
    fix: #3592341 Fix dot-segment encoding for chained ../ and ./ in...

  • godotislate committed 132bc800 on 11.x 
    fix: #3592341 Fix dot-segment encoding for chained ../ and ./ in...

  • godotislate committed 12a9b996 on 11.4.x 
    fix: #3592341 Fix dot-segment encoding for chained ../ and ./ in...

  • godotislate committed c15356bb on 11.3.x 
    fix: #3592341 Fix dot-segment encoding for chained ../ and ./ in...
godotislate’s picture

godotislate
he/him
commented
Status: Reviewed & tested by the community » Patch (to be ported)

Committed and pushed 0105804 to main, 132bc80 to 11.x, 12a9b99 to 11.4.x, and c15356b to 11.3.x.

There are merge conflicts for 11.2.x, 10.6.x, and 10.5.x.

godotislate opened merge request !15908

godotislate opened merge request !15909

godotislate opened merge request !15910

godotislate’s picture

godotislate
he/him
commented
Status: Patch (to be ported) » Needs review

MRs up for 11.2.x, 10.6.x, 10.5.x.

godotislate’s picture

godotislate
he/him
commented

The merge conflict resolution was minor in UrlGenerator.php, because the preceding comment had been edited for code style. I'm going to self-RTBC because the diffs are basically the same.

godotislate’s picture

godotislate
he/him
commented
Status: Needs review » Reviewed & tested by the community

  • catch committed 08a7e666 on 11.2.x 
    fix: #3592341 Fix dot-segment encoding for chained "../" and "./" in...

catch closed merge request !15910

  • catch committed 707c285f on 10.6.x 
    fix: #3592341 Fix dot-segment encoding for chained ../ and ./ in...

catch closed merge request !15909

  • catch committed eb2964e1 on 10.5.x 
    fix: #3592341 Fix dot-segment encoding for chained ../ and ./ in...

catch closed merge request !15908

catch’s picture

catch
he/him
Primary language English
commented
Status: Reviewed & tested by the community » Fixed

Committed/pushed to 11.2.x, 10.6.x and 10.5.x, thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.