The Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption.
The Request class now ensures that URL paths always start with a /.
The patch for this issue is available here for branch 5.4.
We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.
| Score | Percentile |
|---|---|
| 1.84% | 83.00% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 7.3 | 3.1 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-3rg7-wf37-54rm ↗ |
| CVE | CVE-2025-64500 ↗ |
| CWE id | Name |
|---|---|
| CWE-647 | Use of Non-Canonical URL Paths for Authorization Decisions |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| composer | symfony/http-foundation | < 5.4.50 | 5.4.50 | — |
| composer | symfony/http-foundation | >= 6.0.0, < 6.4.29 | 6.4.29 | — |
| composer | symfony/http-foundation | >= 7.0.0, < 7.3.7 | 7.3.7 | — |
| composer | symfony/symfony | >= 2.0.0, < 5.4.50 | 5.4.50 | — |
| composer | symfony/symfony | >= 6.0.0, < 6.4.29 | 6.4.29 | — |
| composer | symfony/symfony | >= 7.0.0, < 7.3.7 | 7.3.7 | — |