PKSA-6z8s-hntv-3x7z: Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name

Q: Which package should be checked in the dependency inventory?

The affected software is identified as composer/symfony/symfony.

Q: Does the available advisory data identify affected or fixed versions?

No affected-version range or fixed version is provided in the available data.

Q: Is a workaround available for environments that cannot patch immediately?

No workaround or mitigation is included in the available data.

Published Nov 4, 2026

Updated

Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name

Affected Software

6 affected componentsFixes available

composer/symfony/symfony>=5.4.50, <5.4.56

5.4.56

composer/symfony/symfony>=6.4.29, <6.4.50

6.4.50

composer/symfony/symfony>=7.3.7, <7.4.0

composer/symfony/symfony>=7.4.0, <7.4.23

7.4.23

composer/symfony/symfony>=8.0.0, <8.1.0

composer/symfony/symfony>=8.1.0, <8.1.11

8.1.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 5.4.56
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 6.4.50
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 7.4.23
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 8.1.11

Event History

Nov 4, 2026

Advisory Published

via Packagist·12:00 AM

Data Sourced

via Packagist·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which package should be checked in the dependency inventory?

The affected software is identified as composer/symfony/symfony.

Does the available advisory data identify affected or fixed versions?

No affected-version range or fixed version is provided in the available data.

Is a workaround available for environments that cannot patch immediately?

No workaround or mitigation is included in the available data.

PKSA-6z8s-hntv-3x7z: Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name

Affected Software

Remediation

Event History

Frequently Asked Questions

Which package should be checked in the dependency inventory?

Does the available advisory data identify affected or fixed versions?

Is a workaround available for environments that cannot patch immediately?

Company

Resources

Contact

Frequently Asked Questions

Which package should be checked in the dependency inventory?

Does the available advisory data identify affected or fixed versions?

Is a workaround available for environments that cannot patch immediately?