FILTER_VALIDATE_URL bypass in PHP 8
July 16, 2021 ◦ 1 min ◦
Identified a vulnerability in PHP's FILTER_VALIDATE_URL filter by discovering a bypass that allowed an invalid URL to be validated. Specifically, the URL https://example.com:\@test.com/ was incorrectly validated as valid, potentially leading to security risks such as misinterpretation of the host.
References: