CVE-2019-11325
Improper Input Validation in Symfony
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
- Record
CVE-2019-11325- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-116
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
- Record
CVE-2019-11325- Updated
- 2026-11-02
EUVDEUVD-2020-0317 No score
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
- Record
EUVD-2020-0317- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w4rc-rx25-8m86
Improper Input Validation in Symfony
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
- Record
GHSA-w4rc-rx25-8m86- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-116
- Updated
- 2026-11-02
OSV
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
- Record
CVE-2019-11325- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-11325
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
- Record
DEBIAN-CVE-2019-11325- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-w4rc-rx25-8m86
Improper Input Validation in Symfony
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
- Record
GHSA-w4rc-rx25-8m86- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-116
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-11325
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
- Record
UBUNTU-CVE-2019-11325- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/symfonyPackagist |
4.2.0 up to 4.2.12 | 4.2.12 |
symfony/symfonyPackagist |
4.3.0 up to 4.3.8 | 4.3.8 |
symfony/var-exporterPackagist |
4.2.0 up to 4.2.12 | 4.2.12 |
symfony/var-exporterPackagist |
4.3.0 up to 4.3.8 | 4.3.8 |
symfonyDebian:12 |
before 4.3.8+dfsg-1 | 4.3.8+dfsg-1 |
symfonyDebian:13 |
before 4.3.8+dfsg-1 | 4.3.8+dfsg-1 |
symfonyDebian:14 |
before 4.3.8+dfsg-1 | 4.3.8+dfsg-1 |
symfony/symfonyPackagist |
4.2.0 up to 4.2.12, plus listed versions v4.2.0v4.2.1v4.2.10v4.2.11v4.2.2 Show 7 moreShow lessv4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9 |
4.2.12 |
symfony/symfonyPackagist |
4.3.0 up to 4.3.8, plus listed versions v4.3.0v4.3.1v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7 |
4.3.8 |
symfony/var-exporterPackagist |
4.2.0 up to 4.2.12, plus listed versions v4.2.0v4.2.1v4.2.10v4.2.11v4.2.2 Show 7 moreShow lessv4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9 |
4.2.12 |
symfony/var-exporterPackagist |
4.3.0 up to 4.3.8, plus listed versions v4.3.0v4.3.1v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7 |
4.3.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-11325 is a critical vulnerability (CVSS 9.8) in Sensiolabs Symfony, published November 21, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.35%, the 88th percentile. Fixed in symfony/symfony 4.2.12.
References
github.com/symfony/var-exporter/compare/d8bf442...57e00f3
symfony.com/blog/symfony-4-3-8-released
nvd.nist.gov/vuln/detail/CVE-2019-11325
Show 7 moreShow less
security-tracker.debian.org/tracker/CVE-2019-11325
ubuntu.com/security/CVE-2019-11325
cve.org/CVERecord?id=CVE-2019-11325