CVE-2025-64500

Published Nov 12, 2025

Last updated 2 months ago

CVSS high 7.3

Symfony

HTTP

Overview

Description: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.
Source: security-advisories@github.com
NVD status: Analyzed
Products: httpfoundation, symfony

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.3
Impact score: 3.4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-647

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sensiolabs:httpfoundation:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5D588185-C231-41DD-AE26-9EF1B0455E74",
            "versionEndExcluding": "5.4.50",
            "versionStartIncluding": "2.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:sensiolabs:httpfoundation:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BB2A74C0-A989-4BAB-BDB3-0A65864B562A",
            "versionEndExcluding": "6.4.29",
            "versionStartIncluding": "6.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:sensiolabs:httpfoundation:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "3F169B04-38C4-4825-A5A2-F010F1BC3D82",
            "versionEndExcluding": "7.3.7",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6E3ADEC4-C8AE-415E-969F-5B4D1C1C701C",
            "versionEndExcluding": "5.4.50",
            "versionStartIncluding": "2.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6E769614-2F0D-4DD4-871D-8AE245F3EC9C",
            "versionEndExcluding": "6.4.29",
            "versionStartIncluding": "6.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6AFA7FF2-0E23-4EC8-923E-3A4A69C75B13",
            "versionEndExcluding": "7.3.7",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References