PKSA-fz6m-r4pd-17c9: Filesystem Path Treats Any Prefix Before "://" as a Root, Letting Paths Escape Their Base Directory

Published Nov 4, 2026

Updated

Filesystem Path Treats Any Prefix Before "://" as a Root, Letting Paths Escape Their Base Directory

Affected Software

13 affected componentsFixes available

composer/symfony/symfony>=5.4.0, <5.4.56

5.4.56

composer/symfony/symfony>=6.0.0, <6.1.0

composer/symfony/symfony>=6.1.0, <6.2.0

composer/symfony/symfony>=6.2.0, <6.3.0

composer/symfony/symfony>=6.3.0, <6.4.0

composer/symfony/symfony>=6.4.0, <6.4.50

6.4.50

composer/symfony/symfony>=7.0.0, <7.1.0

composer/symfony/symfony>=7.1.0, <7.2.0

composer/symfony/symfony>=7.2.0, <7.3.0

composer/symfony/symfony>=7.3.0, <7.4.0

composer/symfony/symfony>=7.4.0, <7.4.23

7.4.23

composer/symfony/symfony>=8.0.0, <8.1.0

composer/symfony/symfony>=8.1.0, <8.1.11

8.1.11

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 5.4.56
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 6.4.50
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 7.4.23
Upgrade
Upgrade composer/symfony/symfony to a version that resolves this vulnerability.
Fixed in 8.1.11

Nov 4, 2026

Advisory Published

via Packagist·12:00 AM

Data Sourced

via Packagist·12:00 AM

DescriptionSeverityAffected Software