~ / search / GHSA-x3cf-w64x-4cp2

GHSA-x3cf-w64x-4cp2

Symfony Path Disclosure

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-19789

Packages

EcosystemPackageAffectedFixed in
Packagist symfony/symfony >= 2.7.0, < 2.7.50 2.7.50
Packagist symfony/symfony >= 2.8.0, < 2.8.49 2.8.49
Packagist symfony/symfony >= 3.0.0, < 3.4.20 3.4.20
Packagist symfony/symfony >= 4.0.0, < 4.0.15 4.0.15
Packagist symfony/symfony >= 4.1.0, < 4.1.9 4.1.9
Packagist symfony/symfony >= 4.2.0, < 4.2.1 4.2.1
Packagist symfony/form >= 2.7.0, < 2.7.50 2.7.50
Packagist symfony/form >= 2.8.0, < 2.8.49 2.8.49
Packagist symfony/form >= 3.0.0, < 3.4.20 3.4.20
Packagist symfony/form >= 4.0.0, < 4.0.15 4.0.15
Packagist symfony/form >= 4.1.0, < 4.1.9 4.1.9
Packagist symfony/form >= 4.2.0, < 4.2.1 4.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint `string` in a setter method (e.g. `setName(string $name)`) of a class that's the `data_class` of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then `UploadedFile::__toString()` is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution.

References

External links from the advisory. They lead to third-party sites.