CVE-2019-10910
Symfony Service IDs Allow Injection
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
- Record
CVE-2019-10910- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
- Record
CVE-2019-10910- Updated
- 2026-11-02
EUVDEUVD-2019-0759 No score
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
- Record
EUVD-2019-0759- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pgwj-prpq-jpc2
Symfony Service IDs Allow Injection
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
- Record
GHSA-pgwj-prpq-jpc2- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
- Record
CVE-2019-10910- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-10910
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
- Record
DEBIAN-CVE-2019-10910- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-pgwj-prpq-jpc2
Symfony Service IDs Allow Injection
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
- Record
GHSA-pgwj-prpq-jpc2- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-10910
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
- Record
UBUNTU-CVE-2019-10910- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/dependency-injectionPackagist |
2.7.0 up to 2.7.51 | 2.7.51 |
symfony/dependency-injectionPackagist |
2.8.0 up to 2.8.50 | 2.8.50 |
symfony/dependency-injectionPackagist |
3.0.0 up to 3.4.26 | 3.4.26 |
symfony/dependency-injectionPackagist |
4.0.0 up to 4.1.12 | 4.1.12 |
symfony/dependency-injectionPackagist |
4.2.0 up to 4.2.7 | 4.2.7 |
symfony/proxy-manager-bridgePackagist |
2.7.0 up to 2.7.51 | 2.7.51 |
symfony/proxy-manager-bridgePackagist |
2.8.0 up to 2.8.50 | 2.8.50 |
symfony/proxy-manager-bridgePackagist |
3.0.0 up to 3.4.26 | 3.4.26 |
symfony/proxy-manager-bridgePackagist |
4.0.0 up to 4.1.12 | 4.1.12 |
symfony/proxy-manager-bridgePackagist |
4.2.0 up to 4.2.7 | 4.2.7 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfony/symfonyPackagist |
2.7.0 up to 2.7.51 | 2.7.51 |
symfony/symfonyPackagist |
2.8.0 up to 2.8.50 | 2.8.50 |
symfony/symfonyPackagist |
3.0.0 up to 3.4.26 | 3.4.26 |
symfony/symfonyPackagist |
4.0.0 up to 4.1.12 | 4.1.12 |
symfony/symfonyPackagist |
4.2.0 up to 4.2.7 | 4.2.7 |
symfonyDebian:12 |
before 3.4.22+dfsg-2 | 3.4.22+dfsg-2 |
symfonyDebian:13 |
before 3.4.22+dfsg-2 | 3.4.22+dfsg-2 |
symfonyDebian:14 |
before 3.4.22+dfsg-2 | 3.4.22+dfsg-2 |
symfonyDebian:8 From an advisory covering 4 CVEs |
before 2.3.21+dfsg-4+deb8u5, plus listed versions 2.3.21+dfsg-42.3.21+dfsg-4+deb8u12.3.21+dfsg-4+deb8u22.3.21+dfsg-4+deb8u32.3.21+dfsg-4+deb8u4 |
2.3.21+dfsg-4+deb8u5 |
symfonyDebian:9 From an advisory covering 8 CVEs |
before 2.8.7+dfsg-1.3+deb9u2, plus listed versions 2.8.7+dfsg-1.32.8.7+dfsg-1.3+deb9u1 |
2.8.7+dfsg-1.3+deb9u2 |
symfony/dependency-injectionPackagist |
2.7.0 up to 2.7.51, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 45 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.49v2.7.5v2.7.50v2.7.6v2.7.7v2.7.8 |
2.7.51 |
symfony/dependency-injectionPackagist |
2.8.0 up to 2.8.50, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 45 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.50 |
symfony/dependency-injectionPackagist |
3.0.0 up to 3.4.26, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.4.26 |
symfony/dependency-injectionPackagist |
4.0.0 up to 4.1.12, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 26 moreShow lessv4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9 |
4.1.12 |
symfony/dependency-injectionPackagist |
4.2.0 up to 4.2.7, plus listed versions v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6 |
4.2.7 |
symfony/proxy-manager-bridgePackagist |
2.7.0 up to 2.7.51, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 45 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.49v2.7.5v2.7.50v2.7.6v2.7.7v2.7.8 |
2.7.51 |
symfony/proxy-manager-bridgePackagist |
2.8.0 up to 2.8.50, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 45 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.50 |
symfony/proxy-manager-bridgePackagist |
3.0.0 up to 3.4.26, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.4.26 |
symfony/proxy-manager-bridgePackagist |
4.0.0 up to 4.1.12, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 26 moreShow lessv4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9 |
4.1.12 |
symfony/proxy-manager-bridgePackagist |
4.2.0 up to 4.2.7, plus listed versions v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6 |
4.2.7 |
symfony/symfonyPackagist |
2.7.0 up to 2.7.51, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 45 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.49v2.7.5v2.7.50v2.7.6v2.7.7v2.7.8 |
2.7.51 |
symfony/symfonyPackagist |
2.8.0 up to 2.8.50, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 45 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.50 |
symfony/symfonyPackagist |
3.0.0 up to 3.4.26, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.4.26 |
symfony/symfonyPackagist |
4.0.0 up to 4.1.12, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 26 moreShow lessv4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9 |
4.1.12 |
symfony/symfonyPackagist |
4.2.0 up to 4.2.7, plus listed versions v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6 |
4.2.7 |
symfonyUbuntu:16.04:LTS |
All versions, plus listed versions 2.7.1+dfsg-12.7.5+dfsg-12.7.9+dfsg-12.7.9+dfsg-1ubuntu22.7.10-0ubuntu2 |
None known |
symfonyUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.13.4.6+dfsg-1ubuntu0.1+esm13.4.6+dfsg-1ubuntu0.1+esm2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10910 is a critical vulnerability (CVSS 9.8) in Sensiolabs Symfony, published May 6, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.02%, the 93rd percentile. Fixed in symfony/dependency-injection 2.7.51.
References
synology.com/security/advisory/Synology_SA_19_19
symfony.com/blog/cve-2019-10910-check-service-ids-are-valid
github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b
nvd.nist.gov/vuln/detail/CVE-2019-10910
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2019-10910
ubuntu.com/security/CVE-2019-10910
drupal.org/SA-CORE-2019-005
cve.org/CVERecord?id=CVE-2019-10910
Left out here: 135 versions. The JSON record has them.