CVE-2025-64500

Published Nov 12, 2025

Last updated 3 days ago

Symfony

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-64500 refers to an issue in Symfony's Request class related to the parsing of PATH_INFO. The class improperly interprets certain PATH_INFO, leading to URLs being represented with a path that doesn't start with a forward slash ("/"). This can allow attackers to bypass access control rules that rely on this "/"-prefix assumption. The vulnerability is addressed by ensuring that URL paths always begin with a "/". A patch is available for the 5.4 branch of Symfony. Drupal also included the fix as a hardening measure in their 11.2.8 release, although Drupal itself does not directly expose the vulnerability.

Description: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.
Source: security-advisories@github.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.3
Impact score: 3.4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-647

Hype score: Not currently trending

References