← All resources

Symfony and Laravel patched same day: 9 advisories (04/11/2026)

Published November 5, 2026 · 7 min read · CyberNovaLabs.io

Nine Symfony advisories and a Laravel patch on the same day, both relayed by CERT-FR. Four of these flaws repair an earlier incomplete fix, so having patched in October is not enough. The exact versions and the questions to ask.

The short version

On 4 November 2026 the Symfony team published nine security advisories in a single day, and Laravel fixed a flaw allowing remote code execution.^[2][4][7] France's CERT-FR relayed both the same day, along with a third batch for Ruby on Rails.^[1][2][3] If your website, customer portal or intranet was custom-built, it very probably runs on one of these foundations, and the only question that matters this week is which version is installed.

What was fixed, and in which versions

Symfony is a PHP development framework; Laravel is another one, which in fact reuses several Symfony components. Both publishers released their patches on 4 November 2026. For Symfony, these are the versions that close the flaws.^[5][6]

For Laravel, the flaw is fixed in version 13.40.0, and the patch was back-ported to the 12.x branch.^[4] CERT-FR describes all versions below 13.40.0 as affected.^[1]

Those numbers are the only thing worth forwarding to your provider. A developer reads the installed version in seconds: the project's composer.lock file holds it, and both frameworks print it from their own command line.

The trap: four of these patches repair an earlier patch

This is what a news summary will not tell you. Of the nine Symfony advisories dated 4 November, four explicitly state that they complete an incomplete fix for an already published flaw: CVE-2026-118513 completes CVE-2026-45063, CVE-2026-118514 completes CVE-2026-45075, CVE-2026-118517 completes CVE-2026-45066, and one advisory on the HtmlSanitizer component completes CVE-2026-48761.^[7]

The practical consequence: we applied the previous security update does not cover you here. CVE-2026-118514 shows why. The fix for CVE-2026-45075 had addressed the same defect only inside three code attributes, and not in the access control rules or the application firewalls.^[5] The flaw stayed open exactly where it mattered most.

This is the second such episode in two weeks. We described the same pattern for PHP in our piece on the NCSC-NL inventory of PHP products with an incomplete patch. The lesson repeats: an applied patch is not a box you tick once, it is a version number you compare at every advisory.

The two Symfony flaws an SME should look at first

The first one concerns forms that accept files (CVE-2026-118515). The Serializer component built an uploaded-file object from request data, so a client could point at a file already sitting on the server and have it handled as if it had just been uploaded.^[6] Depending on what the application then does with that file (store it, serve it back, move it), this exposes files readable by PHP. If you run a customer area that accepts attachments, a job application upload, or a quote form with a drawing attached, this is the one to handle first.

The second one affects access control (CVE-2026-118514). A rule restricted to the GET method did not apply to the same address requested with the HEAD method, because the router serves HEAD requests with the GET handler.^[5] The response carries no body, but its headers go out and the code runs with every side effect it has. A page you believed was restricted could therefore be reached without passing through the application firewall meant to protect it.

Neither flaw is visible from the outside. You cannot spot them by looking at your website: you read them in the version number.

Laravel: remote code execution does not mean everyone is exposed

The Laravel advisory deserves to be read in full before anyone panics. The flaw requires two conditions to be met inside your own application code: it must expose a route that reaches the concurrent-task function, which is not the case by default, and the task launched must write user-supplied data to its standard output.^[4] The publisher itself describes those prerequisites as insecure development practice.

So the risk is real but conditional. That changes nothing about applying the update, which still needs doing; it changes the question you put to your provider, which becomes specific instead of general. None of the advisories we read reports observed exploitation so far. That is not a reason to wait: a public patch makes the flaw readable by everyone, including those who will go looking for it.

Who alerts you, in each of the four countries

The event is European, but the alert channel stays national, and that is what differs depending on where you are established. In France, CERT-FR (ANSSI) advisories are published on cert.cyber.gouv.fr, and they are the ones who relayed Symfony and Laravel on 4 November.^[1][2] In Belgium, the Centre for Cybersecurity Belgium issues its advisories through CERT.be. In the Netherlands, NCSC-NL publishes its own advisories and, this year, inventories of affected products. In Luxembourg, the private sector and municipalities rely on CIRCL, while GOVCERT.LU covers state entities.

If your entity falls under NIS2, the competent authority and the incident reporting deadlines depend on the country of transposition, not on your development framework. We set out the scope country by country, for instance for software vendors and IT providers in the Netherlands. An update applied in time is not a reportable incident, which is precisely the point of not letting it drift.

At CyberNovaLabs.io

We build custom business applications and we follow the advisories of the frameworks they run on: for every client, the installed version is known and compared against CERT-FR and publisher advisories. It is also what we check when auditing an existing site, even one built elsewhere: see our custom software development page and our cybersecurity offer. In the same vein, our articles on the critical PHP flaws of 21 October and on the exploited Drupal Commerce flaw apply the same method to other building blocks. If you do not know what your website runs on, this is a good week to find out: ask for a 20-minute technical review.

Sources

1. CERT-FR, CERTFR-2026-AVI-1457 : Vulnerabilite dans Laravel (04/11/2026)
2. CERT-FR, CERTFR-2026-AVI-1460 : Multiples vulnerabilites dans les produits Symfony (04/11/2026)
3. CERT-FR, CERTFR-2026-AVI-1452 : Multiples vulnerabilites dans Ruby on Rails (04/11/2026)
4. Laravel, bulletin de securite GHSA-63hm-g96r-2m2q : Task Output Injection - Concurrency Process (04/11/2026)
5. Symfony, CVE-2026-118514 : HEAD Requests Bypass the methods Option of access_control and Firewalls (04/11/2026)
6. Symfony, CVE-2026-118515 : The Serializer Builds UploadedFile Objects From Request Data (04/11/2026)
7. Symfony, bulletins de securite publies le 04/11/2026 (liste)

Read next