CVE-2025-64500
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the Request class now ensures that URL paths always start with a /.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the Request class now ensures that URL paths always start with a /.
- Record
CVE-2025-64500- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-647
- Updated
- 2026-11-02
EUVDEUVD-2025-131928
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the Request class now ensures that URL paths always start with a /.
- Record
EUVD-2025-131928- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3rg7-wf37-54rm
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
Description
The Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption.
Resolution
The Request class now ensures that URL paths always start with a /.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.
- Record
GHSA-3rg7-wf37-54rm- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-647
- Updated
- 2026-11-02
NVD
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the Request class now ensures that URL paths always start with a /.
- Record
CVE-2025-64500- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-647
- Updated
- 2026-11-02
OSV
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the Request class now ensures that URL paths always start with a /.
- Record
CVE-2025-64500- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-647
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-64500
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the Request class now ensures that URL paths always start with a /.
- Record
DEBIAN-CVE-2025-64500- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-3rg7-wf37-54rm
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
Description
The Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption.
Resolution
The Request class now ensures that URL paths always start with a /.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.
- Record
GHSA-3rg7-wf37-54rm- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-647
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-64500
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the Request class now ensures that URL paths always start with a /.
- Record
UBUNTU-CVE-2025-64500- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVCLSA-2025-1766451449 No score
TuxCare security update for symfony/http-foundation (1 CVE)
TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in 4.4.49-p1+tuxcare.
- Record
CLSA-2025-1766451449- Updated
- 2026-11-02
OSVCLSA-2026-1768265576 No score
TuxCare security update for symfony/http-foundation (1 CVE)
TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in 2.8.52-p1+tuxcare.
- Record
CLSA-2026-1768265576- Updated
- 2026-11-02
OSVCLSA-2026-1778978781 No score
TuxCare security update for symfony/http-foundation (2 CVEs)
TuxCare rebuilt symfony/http-foundation to address 2 CVEs. Fixed in 3.4.47-p3+tuxcare.
- Record
CLSA-2026-1778978781- Updated
- 2026-11-02
OSVCLSA-2026-1778978921 No score
TuxCare security update for symfony/http-foundation (2 CVEs)
TuxCare rebuilt symfony/http-foundation to address 2 CVEs. Fixed in 3.4.47-p3+tuxcare.
- Record
CLSA-2026-1778978921- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/http-foundationPackagist |
before 5.4.50 | 5.4.50 |
symfony/http-foundationPackagist |
6.0.0 up to 6.4.29 | 6.4.29 |
symfony/http-foundationPackagist |
7.0.0 up to 7.3.7 | 7.3.7 |
symfony/symfonyPackagist |
2.0.0 up to 5.4.50 | 5.4.50 |
symfony/symfonyPackagist |
6.0.0 up to 6.4.29 | 6.4.29 |
symfony/symfonyPackagist |
7.0.0 up to 7.3.7 | 7.3.7 |
symfony/http-foundationTuxCare:Packagist |
v4.4.49 up to 4.4.49-p1+tuxcare | 4.4.49-p1+tuxcare |
symfony/http-foundationTuxCare:Packagist |
v2.8.52 up to 2.8.52-p1+tuxcare | 2.8.52-p1+tuxcare |
symfony/http-foundationTuxCare:Packagist From an advisory covering 2 CVEs |
v3.4.47 up to 3.4.47-p3+tuxcare | 3.4.47-p3+tuxcare |
symfonyDebian:12 |
before 5.4.23+dfsg-1+deb12u5, plus listed versions 5.4.23+dfsg-15.4.23+dfsg-1+deb12u15.4.23+dfsg-1+deb12u25.4.23+dfsg-1+deb12u35.4.23+dfsg-1+deb12u4 |
5.4.23+dfsg-1+deb12u5 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfonyDebian:13 |
before 6.4.21+dfsg-2+deb13u1, plus listed versions 6.4.21+dfsg-2 |
6.4.21+dfsg-2+deb13u1 |
symfonyDebian:14 |
before 7.4.0~rc1+dfsg-1, plus listed versions 6.4.21+dfsg-26.4.24+dfsg-16.4.25+dfsg-17.0.4+dfsg-17.0.5+dfsg-1 Show 31 moreShow less7.0.6+dfsg-17.0.7+dfsg-17.1.0~beta1+dfsg-17.1.0~rc1+dfsg-17.1.2+dfsg-17.1.3+dfsg-17.1.4+dfsg-17.1.5+dfsg-17.2.0~beta1+dfsg-17.2.0~beta2+dfsg-17.2.0~rc1+dfsg-17.2.1+dfsg-17.2.2+dfsg-17.2.3+dfsg-17.2.4+dfsg-17.2.5+dfsg-17.2.6-17.3.0+dfsg-17.3.0~beta1+dfsg-17.3.0~beta2+dfsg-17.3.0~rc1+dfsg-17.3.1+dfsg-17.3.2+dfsg-17.3.3+dfsg-17.3.4+dfsg-17.3.5-17.4.0~beta1-17.4.0~beta1-27.4.0~beta2+dfsg-17.4.0~beta2+dfsg-27.4.0~beta2+dfsg-3 |
7.4.0~rc1+dfsg-1 |
symfony/http-foundationPackagist |
before 5.4.50, plus listed versions 2.0.42.0.52.0.62.0.7v2.0.10 Show 45 moreShow lessv2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11 |
5.4.50 |
symfony/http-foundationPackagist |
6.0.0 up to 6.4.29, plus listed versions v6.0.0v6.0.1v6.0.10v6.0.11v6.0.12 Show 45 moreShow lessv6.0.13v6.0.14v6.0.15v6.0.16v6.0.17v6.0.19v6.0.2v6.0.20v6.0.3v6.0.5v6.0.6v6.0.7v6.0.8v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-BETA2v6.1.0-RC1v6.1.1v6.1.11v6.1.12v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.8v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA3v6.2.0-RC1v6.2.1v6.2.10v6.2.11v6.2.12v6.2.13v6.2.2v6.2.5v6.2.6v6.2.7v6.2.8v6.3.0v6.3.0-BETA1 |
6.4.29 |
symfony/http-foundationPackagist |
7.0.0 up to 7.3.7, plus listed versions v7.0.0v7.0.10v7.0.3v7.0.4v7.0.6 Show 35 moreShow lessv7.0.7v7.0.8v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.10v7.1.11v7.1.3v7.1.5v7.1.6v7.1.7v7.1.8v7.1.9v7.2.0v7.2.0-BETA1v7.2.0-BETA2v7.2.0-RC1v7.2.2v7.2.3v7.2.5v7.2.6v7.2.7v7.2.8v7.2.9v7.3.0v7.3.0-BETA1v7.3.0-BETA2v7.3.0-RC1v7.3.1v7.3.2v7.3.3v7.3.4v7.3.5v7.3.6 |
7.3.7 |
symfony/symfonyPackagist |
2.0.0 up to 5.4.50, plus listed versions 2.0.42.0.52.0.62.0.7v2.0.10 Show 45 moreShow lessv2.0.11v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.0-BETA1v2.1.0-BETA2v2.1.0-BETA3v2.1.0-BETA4v2.1.0-RC1v2.1.0-RC2v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.0-BETA1v2.2.0-BETA2v2.2.0-RC1v2.2.0-RC2v2.2.0-RC3v2.2.1v2.2.10v2.2.11 |
5.4.50 |
symfony/symfonyPackagist |
6.0.0 up to 6.4.29, plus listed versions v6.0.0v6.0.1v6.0.10v6.0.11v6.0.12 Show 45 moreShow lessv6.0.13v6.0.14v6.0.15v6.0.16v6.0.17v6.0.18v6.0.19v6.0.2v6.0.20v6.0.3v6.0.4v6.0.5v6.0.6v6.0.7v6.0.8v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-BETA2v6.1.0-RC1v6.1.1v6.1.10v6.1.11v6.1.12v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.8v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA2v6.2.0-BETA3v6.2.0-RC1v6.2.0-RC2v6.2.1v6.2.10v6.2.11v6.2.12v6.2.13v6.2.14v6.2.2 |
6.4.29 |
symfony/symfonyPackagist |
7.0.0 up to 7.3.7, plus listed versions v7.0.0v7.0.1v7.0.10v7.0.2v7.0.3 Show 43 moreShow lessv7.0.4v7.0.5v7.0.6v7.0.7v7.0.8v7.0.9v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.10v7.1.11v7.1.2v7.1.3v7.1.4v7.1.5v7.1.6v7.1.7v7.1.8v7.1.9v7.2.0v7.2.0-BETA1v7.2.0-BETA2v7.2.0-RC1v7.2.1v7.2.2v7.2.3v7.2.4v7.2.5v7.2.6v7.2.7v7.2.8v7.2.9v7.3.0v7.3.0-BETA1v7.3.0-BETA2v7.3.0-RC1v7.3.1v7.3.2v7.3.3v7.3.4v7.3.5v7.3.6 |
7.3.7 |
symfonyUbuntu:16.04:LTS |
All versions, plus listed versions 2.7.1+dfsg-12.7.5+dfsg-12.7.9+dfsg-12.7.9+dfsg-1ubuntu22.7.10-0ubuntu2 |
None known |
symfonyUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.13.4.6+dfsg-1ubuntu0.1+esm13.4.6+dfsg-1ubuntu0.1+esm2 |
None known |
symfonyUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.3.4+dfsg-1ubuntu14.3.8+dfsg-1ubuntu14.3.8+dfsg-1ubuntu1+esm14.3.8+dfsg-1ubuntu1+esm2 |
None known |
symfonyUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.2.6+dfsg-1ubuntu75.4.4+dfsg-1ubuntu85.4.4+dfsg-1ubuntu8+esm1 |
None known |
symfonyUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 5.4.23+dfsg-1ubuntu15.4.35+dfsg-3ubuntu16.4.5+dfsg-3ubuntu26.4.5+dfsg-3ubuntu36.4.5+dfsg-3ubuntu3+esm1 |
None known |
symfonyUbuntu:25.10 |
All versions, plus listed versions 6.4.18+dfsg-1ubuntu16.4.21+dfsg-26.4.21+dfsg-2ubuntu16.4.24+dfsg-1 |
None known |
symfonyUbuntu:26.10 |
All versions, plus listed versions 7.4.7+dfsg-1ubuntu17.4.9+dfsg-1ubuntu17.4.13+dfsg-2ubuntu17.4.14+dfsg-1ubuntu27.4.15+dfsg-2ubuntu27.4.16+dfsg-1ubuntu2 |
None known |
symfonyUbuntu:26.04:LTS |
All versions, plus listed versions 6.4.24+dfsg-17.4.5+dfsg-1ubuntu17.4.6+dfsg-2ubuntu17.4.7+dfsg-1ubuntu1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Symfony HttpFoundation - Access Control Bypass via PATH_INFO |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-64500 is a high vulnerability (CVSS 7.3) in Sensiolabs Httpfoundation, published November 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in symfony/http-foundation 5.4.50.
References
github.com/symfony/symfony/security/advisories/GHSA-3rg7-wf37-54rm
symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass
nvd.nist.gov/vuln/detail/CVE-2025-64500
Left out here: 1,200 versions. The JSON record has them.