Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

CAO 7.3CVE-2025-64500 · GHSA-3rg7-wf37-54rm · Công bố 12/11/2025 · cập nhật 19/10/2026

Tóm tắt nhanh

CVE-2025-64500 là lỗ hổng mức CAO (CVSS 7.3) ảnh hưởng symfony/http-foundation, symfony/symfony, httpfoundation (sensiolabs).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.4%, cao hơn 72.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.4.29, 7.3.7, 5.4.50 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
symfony/http-foundation Packagist	`≥ 6.0.0, < 6.4.29≥ 7.0.0, < 7.3.7< 5.4.50`	`6.4.297.3.75.4.50`
symfony/symfony Packagist	`≥ 2.0.0, < 5.4.50≥ 6.0.0, < 6.4.29≥ 7.0.0, < 7.3.7`	`5.4.506.4.297.3.7`
httpfoundation sensiolabs	`≥ 2.0.0, < 5.4.50≥ 6.0.0, < 6.4.29≥ 7.0.0, < 7.3.7`	`5.4.506.4.297.3.7`
symfony sensiolabs	`≥ 2.0.0, < 5.4.50≥ 6.0.0, < 6.4.29≥ 7.0.0, < 7.3.7`	`5.4.506.4.297.3.7`

Mô tả

Description

The Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption.

Resolution

The Request class now ensures that URL paths always start with a /.

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.

Mô tả của NVD

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.