CVE-2025-64500: Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
Description
The Request class improperly interprets some PATHINFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption.
Resolution
The Request class now ensures that URL paths always start with a /.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.
Other sources
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the Request class improperly interprets some PATHINFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the Request class now ensures that URL paths always start with a /.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64500?
CVE-2025-64500 has a medium severity rating as it allows unauthorized access by bypassing certain access control measures.
How do I fix CVE-2025-64500?
To fix CVE-2025-64500, update Symfony HttpFoundation to version 5.4.50, 6.4.29, or 7.3.7 or later.
Which versions of Symfony are affected by CVE-2025-64500?
CVE-2025-64500 affects Symfony HttpFoundation versions 2.0.0 to 5.4.50, 5.4.50 to 6.4.29, and 6.4.29 to 7.3.7.
What impact does CVE-2025-64500 have on web applications?
CVE-2025-64500 can lead to unauthorized access by improper URL path handling, allowing attackers to bypass access controls.
Is CVE-2025-64500 a local or remote vulnerability?
CVE-2025-64500 is considered a remote vulnerability as it can be exploited through crafted requests to web applications.