~ / search / GHSA-3rg7-wf37-54rm

GHSA-3rg7-wf37-54rm

Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

Source: GitHub Advisory Database (reviewed) High CVE-2025-64500

Packages

EcosystemPackageAffectedFixed in
Packagist symfony/http-foundation < 5.4.50 5.4.50
Packagist symfony/http-foundation >= 6.0.0, < 6.4.29 6.4.29
Packagist symfony/http-foundation >= 7.0.0, < 7.3.7 7.3.7
Packagist symfony/symfony >= 2.0.0, < 5.4.50 5.4.50
Packagist symfony/symfony >= 6.0.0, < 6.4.29 6.4.29
Packagist symfony/symfony >= 7.0.0, < 7.3.7 7.3.7

Details

As written in the advisory (Markdown source, shown as plain text).

### Description The `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. ### Resolution The `Request` class now ensures that URL paths always start with a `/`. The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac) for branch 5.4. ### Credits We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.

References

External links from the advisory. They lead to third-party sites.