{"id":"CVE-2020-15094","aliases":["BIT-symfony-2020-15094","DEBIAN-CVE-2020-15094","EUVD-2020-0840","GHSA-754h-5r27-7x3r"],"status":"published","title":"RCE in Symfony","description":"In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03043,"percentile":0.87623,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-212"],"published":"2020-09-02T17:29:56Z","modified":"2026-10-26T12:00:41Z","fixes":[{"ecosystem":"Packagist","package":"symfony/http-kernel","fixed_in":["5.1.5","4.4.13"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"symfony/symfony","fixed_in":["5.1.5","4.4.13"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"symfony","fixed_in":["4.4.13","5.1.5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"symfony","fixed_in":["4.4.13+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"symfony","fixed_in":["4.4.13+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"symfony","fixed_in":["4.4.13+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"symfony/http-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.1.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.1.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/http-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.4.13"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.4.13"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"symfony","ranges":[{"type":"SEMVER","events":[{"introduced":"4.4.0"},{"fixed":"4.4.13"},{"introduced":"5.1.0"},{"fixed":"5.1.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.13+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.13+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.13+dfsg-1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"symfony/http-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.4.13"}]}],"versions":["v4.3.0","v4.3.1","v4.3.10","v4.3.11","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.3.6","v4.3.7","v4.3.8","v4.3.9","v4.4.0","v4.4.0-BETA1","v4.4.0-BETA2","v4.4.0-RC1","v4.4.1","v4.4.10","v4.4.11","v4.4.12","v4.4.2","v4.4.3","v4.4.4","v4.4.5","v4.4.6","v4.4.7","v4.4.8","v4.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/http-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.1.5"}]}],"versions":["v5.0.0","v5.0.1","v5.0.10","v5.0.11","v5.0.2","v5.0.3","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.0-BETA1","v5.1.0-RC1","v5.1.0-RC2","v5.1.1","v5.1.2","v5.1.3","v5.1.4"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.4.13"}]}],"versions":["v4.3.0","v4.3.1","v4.3.10","v4.3.11","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.3.6","v4.3.7","v4.3.8","v4.3.9","v4.4.0","v4.4.0-BETA1","v4.4.0-BETA2","v4.4.0-RC1","v4.4.1","v4.4.10","v4.4.11","v4.4.12","v4.4.2","v4.4.3","v4.4.4","v4.4.5","v4.4.6","v4.4.7","v4.4.8","v4.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"symfony/symfony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.1.5"}]}],"versions":["v5.0.0","v5.0.1","v5.0.10","v5.0.11","v5.0.2","v5.0.3","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.0-BETA1","v5.1.0-RC1","v5.1.0-RC2","v5.1.1","v5.1.2","v5.1.3","v5.1.4"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"sensiolabs","product":"httpclient"},{"vendor":"sensiolabs","product":"symfony"},{"vendor":"symfony","product":"symfony"}],"references":[{"url":"https://github.com/symfony/symfony/security/advisories/GHSA-754h-5r27-7x3r","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web","fix"]},{"url":"https://packagist.org/packages/symfony/symfony","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","web","advisory"]},{"url":"https://packagist.org/packages/symfony/http-kernel","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAQJXAKWPMWB7OL6QPG2ZSEQZYYPU5RC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HNGUWOEETOFVH4PN3I3YO4QZHQ4AUKF3/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15094","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VAQJXAKWPMWB7OL6QPG2ZSEQZYYPU5RC/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HNGUWOEETOFVH4PN3I3YO4QZHQ4AUKF3/"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2020-15094.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2020-15094.yaml","tags":["web"]},{"url":"https://symfony.com/cve-2020-15094","tags":["web"]},{"url":"https://github.com/advisories/GHSA-754h-5r27-7x3r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15094","tags":["advisory"]},{"url":"https://github.com/symfony/symfony","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HNGUWOEETOFVH4PN3I3YO4QZHQ4AUKF3","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VAQJXAKWPMWB7OL6QPG2ZSEQZYYPU5RC","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-15094","title":"RCE in Symfony","description":"In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.","status":"published","published":"2020-09-02T17:35:15Z","modified":"2024-08-04T13:08:22.072Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-212"],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2020-0840","description":"In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.","status":"published","published":"2020-09-02T17:35:15Z","modified":"2024-08-04T13:08:22Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:07:32.55679Z"}],"ghsa":[{"id":"GHSA-754h-5r27-7x3r","title":"RCE in Symfony","description":"Description\n-----------\n\nThe `CachingHttpClient` class from the HttpClient Symfony component relies on the `HttpCache` class to handle requests. `HttpCache` uses internal headers like `X-Body-Eval` and `X-Body-File` to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by `CachingHttpClient` and if an attacker can control the response for a request being made by the `CachingHttpClient`, remote code execution is possible.\n\nResolution\n----------\n\nHTTP headers designed for internal use in `HttpCache` are now stripped from remote responses before being passed to `HttpCache`.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78) for the 4.4 branch.\n\nCredits\n-------\n\nI would like to thank Matthias Pigulla (webfactory GmbH) for reporting and fixing the issue.","status":"published","published":"2020-09-02T17:29:56Z","modified":"2024-02-15T05:06:49Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-212"],"updated_at":"2026-11-02T14:37:38.20753Z"}],"nvd":[{"id":"CVE-2020-15094","description":"In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.","status":"published","published":"2020-09-02T18:15:11.187Z","modified":"2026-06-17T02:56:02.457Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-212"],"updated_at":"2026-11-02T14:06:13.600965Z"}],"osv":[{"id":"CVE-2020-15094","description":"In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.","status":"published","published":"2020-09-02T18:15:11.187Z","modified":"2026-10-24T10:47:48.363394206Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-15094","description":"In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.","status":"published","published":"2020-09-02T18:15:11.187Z","modified":"2026-10-26T12:00:41.813971887Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"GHSA-754h-5r27-7x3r","title":"RCE in Symfony","description":"Description\n-----------\n\nThe `CachingHttpClient` class from the HttpClient Symfony component relies on the `HttpCache` class to handle requests. `HttpCache` uses internal headers like `X-Body-Eval` and `X-Body-File` to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by `CachingHttpClient` and if an attacker can control the response for a request being made by the `CachingHttpClient`, remote code execution is possible.\n\nResolution\n----------\n\nHTTP headers designed for internal use in `HttpCache` are now stripped from remote responses before being passed to `HttpCache`.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78) for the 4.4 branch.\n\nCredits\n-------\n\nI would like to thank Matthias Pigulla (webfactory GmbH) for reporting and fixing the issue.","status":"published","published":"2020-09-02T17:29:56Z","modified":"2026-07-08T06:29:30.177347473Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-212"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"BIT-symfony-2020-15094","description":"In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.","status":"published","published":"2024-03-06T11:08:55.587Z","modified":"2024-03-06T11:25:28.861Z","updated_at":"2026-11-02T15:28:35.51001Z"}]}}