Symfony 8.1.10 is a maintenance release, but it carries a security fix in the Mime component, and Mime reaches further than the Symfony apps you’d expect. If you generate email anywhere in a PHP stack, this one is worth a look.
What Was Actually Fixed
The headline is CVE-2026-45070: the Mime component accepted parameter names that contained non-token characters, and now rejects them. Mime header parameters show up in places like Content-Type and Content-Disposition, for example the name and filename on an attachment. When a value that flows into one of those parameters isn’t constrained, an attacker can smuggle characters that break out of the intended header structure. Rejecting non-token parameter names closes that at the source.
It doesn’t travel alone. Several other Mime hardening fixes shipped in the same release: quotes and backslashes are now escaped in quoted parameter values, Address::getEncodedName() escapes backslashes, and unserializing TextPart, SMimePart, and Email now rejects non-string values instead of trusting them. Taken together, this is a round of making the component strict about what it will accept into a message. One more worth noting outside Mime: the Serializer now escapes formulas in the header row of CSV exports, closing a CSV-injection gap.
Why This One Hits Wide
The reach here is bigger than “Symfony apps.” Symfony Mailer and Mime are the engine under a lot of PHP email, including Laravel, whose mail layer is built on symfony/mailer and symfony/mime. So even if you’ve never written a line of Symfony, there’s a good chance this component is composing your application’s email through a transitive dependency.
If you build messages with any user-influenced attachment names, content-type parameters, or header values, prioritize the upgrade. composer update symfony/mime (or symfony/mailer, which pulls it in) gets most projects on the 8.1 line to the fix. If you’re on another supported branch, check for the matching patch release on your line rather than assuming you’re covered.
How Scout Sees What Changes After You Upgrade
Most email goes out through a queued job, and that’s exactly where Scout Monitoring traces it, alongside your controllers, database queries, and external calls. After tightening a component in the mail path, Scout’s trace view is where you’d confirm your send jobs still complete cleanly and nothing started throwing on a message the stricter Mime rules now reject, so a legitimate edge case doesn’t turn into silently dropped mail.
For application monitoring with errors, logs, and traces, Scout Monitoring provides the fastest insights without the bloat.