Symfony security advisories
Latest symfony components release 8.1.11 Covers the symfony components and 4 first-party packages.
23 advisories affect supported versions.
Supported components branches
| Branch | Latest safe version | Security support until |
|---|---|---|
| 8.1 | 8.1.11 | Jan 31, 2027 |
| 7.4 | 7.4.23 | Nov 30, 2029 |
| 6.4 | 6.4.50 | Nov 30, 2027 |
| 5.4 | 5.4.56 | Feb 28, 2029 |
First-party packages
Packages the Symfony team maintains, each with its own page. Their advisories are listed below alongside the components's.
| Package | Latest release | Status |
|---|---|---|
| Symfony components symfony/http-kernel | 8.1.11 | 23 open |
| Twig twig/twig | 3.30.0 | No open advisories |
| Symfony UX symfony/ux-live-component | 3.7.2 | No open advisories |
| MakerBundle symfony/maker-bundle | 1.68.0 | No open advisories |
| Monolog Bundle symfony/monolog-bundle | 4.1.0 | No advisories |
Check your version
Type the version of the package you run to see which advisories affect it.
All Symfony advisories
167 advisories, newest first.
-
low Symfony · · Reviewed
Symfony HtmlSanitizer: Hostless URLs Slip Past Link and Media Host Lists
Lets links or media point to hosts outside allowLinkHosts() or allowMediaHosts() when allowRelativeLinks or allowRelativeMedias is on.
Fixed in 8.1.11, 7.4.23 and 6.4.50
-
high Symfony · · Reviewed
Symfony Security: HEAD Requests Skip access_control Rules Limited to GET
Lets HEAD requests reach pages that access_control rules or firewalls protect only for GET, running the controller without the check.
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56
-
high Symfony · · Reviewed
Symfony X509 Login: Crafted Certificate Names Can Log In as Another User
Lets a client certificate holder log in as another user's email address in apps that use Symfony's X509 authenticator.
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56
-
high Symfony · · Reviewed
Symfony Serializer: Fake UploadedFile Data Can Point at Any Server File
Lets a client make an app treat any server file as an upload in apps that deserialize request data into UploadedFile properties.
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56
-
high Symfony · · Reviewed
Symfony Routing: Host Placeholders Can Bypass Path-Based Access Rules
Lets requests reach controllers that path-based access_control rules protect, in apps with routes that use host placeholders.
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56
-
medium Symfony · · Reviewed
Symfony Validator: Ip Constraint Accepts Some Internal Addresses as Public
Lets internal addresses pass #[Assert\Ip] public or no-private checks, getting past SSRF guards built on the Ip constraint.
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56
-
low Symfony · · Reviewed
Symfony HttpFoundation: Paths Glued to index.php Bypass Web Server Path Rules
Lets requests get past nginx, Apache, CDN or WAF rules on a path like /admin, while Symfony still routes them to that path.
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56
-
medium Symfony · · Reviewed
Symfony: private_ranges Trusted Proxies Setting Trusts Some Remote Clients
Lets some IPv6 clients pass as trusted proxies and set X-Forwarded headers in apps that use trusted_proxies: private_ranges.
Fixed in 8.1.11 and 7.4.23
-
medium Symfony · · Reviewed
Symfony HttpFoundation: Crafted Links Make Generated URLs Point Elsewhere
Lets a crafted link make an app's links, forms and redirects point to another host, when its front controller sits in a subdirectory.
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56
-
high Symfony · · Reviewed
Symfony Yaml: Small Documents Can Tie Up the Parser for Minutes
Lets an attacker keep a PHP worker busy with one small YAML document in apps that parse untrusted YAML, including some #[MapRequestPayload] endpoints.
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56
-
high Symfony · · Reviewed
Symfony Serializer: Data URIs Can Read Any File on the Server
Lets a client read any file PHP can read in apps that deserialize client data into SplFileObject, SplFileInfo or File properties.
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56
-
medium Symfony · · Reviewed
Symfony Serializer: Nested Properties Marked #[Ignore] Can Still Be Set
Lets a client set #[Ignore] properties on nested objects in apps that deserialize input with ObjectNormalizer, such as #[MapRequestPayload].
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56 · 1 older release
-
low Symfony · · Reviewed
Symfony Security: Programmatic Logins Skip checkPostAuth() User Checks
Lets accounts a user checker rejects in checkPostAuth(), such as expired ones, log in through Security::login() or authenticateUser().
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56
-
low Symfony · · Reviewed
Symfony HtmlSanitizer: srcset Images Skip Media Scheme and Host Checks
Lets sanitized HTML load images from hosts outside allowMediaHosts() through srcset or imagesrcset attributes.
Fixed in 8.1.11, 7.4.23 and 6.4.50
-
high Symfony · · Reviewed
Symfony HttpClient: Scoped Client Can Send Credentials to Other Hosts
Can send a scoped client's token or other credentials to another host when an attacker controls the start of a URL the app requests.
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56
-
low Symfony · · Reviewed
Symfony Config: XmlUtils::parse() Resolves External Entities in Untrusted XML
Can reveal whether server files exist, or leak them through network stream wrappers, in apps that pass untrusted XML to XmlUtils::parse().
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56
-
medium Symfony · · Reviewed
Symfony HtmlSanitizer: Meta Refresh URLs Slip Past Link Checks
Lets meta refresh tags send visitors to blocked hosts or javascript: URLs in apps that allow meta refresh through HtmlSanitizer.
Fixed in 8.1.11, 7.4.23 and 6.4.50
-
low Symfony · · Reviewed
Symfony HttpKernel: Inline Fragments Let Forwarded Headers Change URLs
Lets client headers set the host of absolute URLs after an inline fragment renders, in apps reached from 127.0.0.1 without it as a trusted proxy.
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56 · 2 older releases
-
high Symfony · · Reviewed
Symfony Filesystem: Crafted Paths Can Escape Their Base Directory
Lets an attacker read or write files outside an allowed folder in apps that check user paths with Path, and lets packages write outside assets/vendor.
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56
-
low Symfony · · Reviewed
Symfony HttpClient: DNS Rebinding Lets NoPrivateNetworkHttpClient Probe Ports
Lets an attacker who controls a host's DNS probe internal hosts and ports through repeated NoPrivateNetworkHttpClient requests to that host.
Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56
-
medium Symfony · · Reviewed
Symfony JsonPath: Crafted Queries Can Still Tie Up a Worker
Lets an attacker keep a PHP worker busy for minutes in apps that run JSONPath queries an attacker can influence, despite the CVE-2026-45756 fix.
Fixed in 8.1.11 and 7.4.23
-
medium Symfony · · Reviewed
Symfony Mime: Header Injection Through Mime Parameter Names
Lets an attacker add extra email headers in apps that build a Content-Type or Content-Disposition parameter name from user input.
Fixed in 8.1.10, 7.4.22, 6.4.49 and 5.4.55
-
medium Symfony · · Reviewed
Symfony ExpressionLanguage: Deeply Nested Expressions Crash PHP
Lets an attacker crash the PHP process with one request in apps that parse or validate expressions written by users.
Fixed in 8.1.9, 7.4.21, 6.4.48 and 5.4.54
-
high Symfony · · Reviewed
Symfony HttpFoundation: Crafted Cache-Control Header Ties Up the CPU
Lets an unauthenticated attacker burn close to a second of CPU per request with a crafted Cache-Control header, in any app built on HttpFoundation.
Fixed in 8.1.7, 7.4.19, 6.4.46 and 5.4.54
-
high Symfony · · Reviewed
Symfony Yaml: Deeply Nested Inline YAML Crashes the Process
Lets an attacker crash the PHP process with one YAML document in apps that parse untrusted YAML, including some #[MapRequestPayload] endpoints.
Fixed in 8.1.6, 7.4.18, 6.4.45 and 5.4.54
-
high Symfony Twig · · Reviewed
Twig Sandbox: Allow-List Bypass When Sandbox State Changes
Lets an untrusted template use forbidden filters, tags and functions when one Twig environment renders both sandboxed and normal templates.
No fixed release listed yet
-
high Symfony Symfony UX · · Reviewed
Symfony UX Toolkit: Malicious Kit Can Read and Write Any File
Lets a crafted or compromised recipe kit read or overwrite files outside the project when you run ux:install, which can lead to running code.
Fixed in 3.2.0 and 2.36.1
-
medium Symfony Symfony UX · · Reviewed
Symfony UX Icons: Malicious SVG Icons Can Run Scripts in the Page
Lets a malicious icon file or Iconify endpoint run script in visitors' browsers in apps that render icons with ux_icon().
Fixed in 3.2.0 and 2.36.1
-
medium Symfony · · Reviewed
Symfony Runtime: Web Requests Can Still Switch APP_ENV and APP_DEBUG
Lets an unauthenticated request change the app environment or debug mode on servers with register_argc_argv=On, bypassing the CVE-2024-50340 fix.
Fixed in 6.4.40 and 5.4.52 · 2 older releases
-
medium Symfony Symfony UX · · Reviewed
Symfony UX Live Component: Date Props Accept Relative Dates
Lets a client move a writable date prop to any point in time, getting past date-based checks in live components.
Fixed in 3.1.0 and 2.36.0
-
low Symfony Symfony UX · · Reviewed
Symfony UX Live Component: Large Batch Requests Can Overload the Server
Lets a logged-in user tie up CPU, memory and database connections by sending one batch request with thousands of live actions.
Fixed in 3.1.0 and 2.36.0
-
low Symfony Symfony UX · · Reviewed
Symfony UX Live Component: LiveAction CSRF Check Can Be Bypassed
Lets another site trigger live actions in a user's session, in apps whose session cookies use SameSite=None.
Fixed in 3.1.0 and 2.36.0
-
medium Symfony Symfony UX · · Reviewed
Symfony UX Live Component: Cross-Site Scripting via Child Component Tag
Lets an attacker inject HTML into a live component re-render, mainly in apps that have relaxed CORS for the live component endpoint.
Fixed in 3.1.0 and 2.36.0
-
low Symfony Symfony UX · · Reviewed
Symfony UX Live Component: Signed Props Can Be Reused Across Components
Lets a client reuse signed read-only props from one live component in another whose prop names match, changing state it shouldn't.
Fixed in 3.1.0 and 2.36.0
-
medium Symfony Symfony UX · · Reviewed
Symfony UX Autocomplete: Stored Cross-Site Scripting in Dropdown Results
Lets an attacker run script in other users' browsers when autocomplete results come from content users can write.
Fixed in 3.1.0 and 2.36.0
-
medium Symfony Symfony UX · · Reviewed
Symfony UX Autocomplete: Wildcards Expose Unlisted Entity Data
Lets anyone probe every column of an entity through a public autocomplete endpoint by sending search wildcards.
Fixed in 3.1.0 and 2.36.0
-
medium Symfony Twig · · Reviewed
Twig Sandbox: column Filter Reads Blocked Properties Under a Source Policy
Lets an untrusted template read blocked object properties with the column filter when the sandbox is set by a source policy.
Fixed in 3.27.0
-
low Symfony Twig · · Reviewed
Twig Sandbox: Deprecated Helper Functions Skip Sandbox Checks
Lets sandboxed templates get around callable checks through deprecated Twig helper functions still used by older third-party code.
Fixed in 3.27.0
-
high Symfony Twig · · Reviewed
Twig Sandbox: Allow-List Bypass When Sandbox State Changes
Lets an untrusted template use forbidden filters, tags and functions when one Twig environment renders both sandboxed and normal templates.
Fixed in 3.27.0
-
medium Symfony Twig · · Reviewed
Twig Sandbox: __toString() Bypass via Dynamic Mapping Keys
Lets an untrusted template call __toString() on objects the sandbox policy blocks, a leftover gap from the GHSA-pr2w-4gpj-cpq4 fix.
Fixed in 3.27.0
-
medium Symfony Twig · · Reviewed
Twig Sandbox: __toString() Bypass via join, replace and in
Lets an untrusted template call __toString() on objects the sandbox policy blocks, a leftover gap from the GHSA-pr2w-4gpj-cpq4 fix.
Fixed in 3.27.0
-
medium Symfony · · Reviewed
Symfony HttpClient: IPv6 Transition Addresses Bypass Private Network Block
Lets an attacker reach private network hosts through NoPrivateNetworkHttpClient by using IPv6 addresses that wrap a private IPv4 address.
Fixed in 7.4.13, 6.4.41 and 5.4.53 · 1 older release
-
medium Symfony · · Reviewed
Symfony HtmlSanitizer: Some URL Attributes Skip URL Checks
Lets javascript: and other blocked URLs through in attributes like object data, in apps that allow those attributes in HtmlSanitizer.
Fixed in 7.4.13 and 6.4.41 · 1 older release
-
medium Symfony · · Reviewed
Symfony Routing: Chained ../ in Parameters Escape Generated URLs
Can make URLs built by UrlGenerator point to a different path than intended when a route parameter holds a chain of ../ or ./ segments.
Fixed in 7.4.13, 6.4.41 and 5.4.53 · 1 older release
-
medium Symfony · · Reviewed
Symfony Mailer Mailomat: Webhook Request Picks Its Own HMAC Algorithm
Lets a Mailomat webhook request choose a weak HMAC algorithm for its signature check, weakening webhook authentication.
Fixed in 7.4.13 · 1 older release
-
medium Symfony · · Reviewed
Symfony HtmlSanitizer: Encoded BiDi Marks Slip Past Link Spoofing Checks
Lets percent-encoded direction marks and Unicode spaces through HtmlSanitizer, so decoded links can be made to look like other domains.
Fixed in 7.4.13 and 6.4.41 · 1 older release
-
high Symfony · · Reviewed
Symfony Security: failure_forward Lets Anyone Reach Protected Pages
Lets an unauthenticated user load access_control-protected GET routes in apps that use form login with failure_forward turned on.
Fixed in 7.4.13, 6.4.41 and 5.4.53 · 1 older release
-
low Symfony · · Reviewed
Symfony Polyfill IDN: Invalid xn-- Labels Treated as Normal Domains
Can let two different domain names compare as equal, getting past domain blocklists, on PHP installs without the intl extension.
Only affects branches that no longer get security fixes
-
low Symfony · · Reviewed
Symfony Yaml: Alias Expansion Can Use Up All Memory
Lets a small YAML document expand into gigabytes of data through aliases, in apps that parse untrusted YAML.
Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release
-
medium Symfony · · Reviewed
Symfony Mailer: Recipient Addresses Can Become Sendmail Options
Lets a recipient address starting with a dash pass options to sendmail, in apps using SendmailTransport in -t mode.
Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release
-
low Symfony · · Reviewed
Symfony Yaml: Crafted Header Line Makes the Parser Hang
Lets an attacker tie up the parser for a long time with one crafted YAML header or comment line, in apps that parse untrusted YAML.
Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release
-
low Symfony · · Reviewed
Symfony HtmlSanitizer: javascript: URLs Survive in Form and Media Attributes
Can allow cross-site scripting through action, formaction, poster or cite attributes in apps that allow them in HtmlSanitizer.
Fixed in 7.4.12 and 6.4.40 · 1 older release
-
low Symfony · · Reviewed
Symfony DomCrawler: addXmlContent() Can Read Local Files
Can expose local server files when an app loads untrusted XML with Crawler::addXmlContent(), including pages fetched by HttpBrowser.
Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release
-
medium Symfony · · Reviewed
Symfony Mailer Mailjet and LOX24: Webhook Secrets Are Never Checked
Lets anyone send fake email or SMS events to apps that use the Mailjet or LOX24 webhook parsers, even with a secret set.
Fixed in 7.4.12 and 6.4.40 · 1 older release
-
medium Symfony · · Reviewed
Symfony Twilio Notifier: Webhooks Accepted Without Checking Twilio's Signature
Lets anyone who finds a Twilio webhook endpoint send fake SMS status events, even when a webhook signing secret is configured.
Fixed in 7.4.12 and 6.4.40 · 1 older release
-
low Symfony · · Reviewed
Symfony JsonPath: User-Supplied Regex in match() or search() Can Stall Workers
Lets an attacker tie up CPU in apps that evaluate JSONPath expressions taken from user input with JsonCrawler.
Fixed in 7.4.12 · 1 older release
-
high Symfony · · Reviewed
Symfony server:log Command: Network Listener Unserializes Untrusted Data
Lets anyone who can reach port 9911 on a machine running server:log crash it or inject PHP objects, and in some setups run code.
Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release
-
medium Symfony · · Reviewed
Symfony OidcTokenHandler: Tokens Without aud, iss or exp Claims Are Accepted
Lets a validly signed OpenID Connect token that leaves out its audience, issuer or expiry claim pass Symfony's OIDC token check.
Fixed in 7.4.12 and 6.4.40 · 1 older release
-
medium Symfony · · Reviewed
Symfony Cache PdoAdapter: SQL Injection Through the clear() Prefix
Allows SQL injection, such as deleting other rows, in apps that pass untrusted input as the prefix to PdoAdapter's clear() method.
Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release
-
medium Symfony · · Reviewed
Symfony HtmlSanitizer: Malformed URLs Slip Past Link and Media Host Lists
Lets sanitized HTML link or load media from hosts outside allowLinkHosts() or allowMediaHosts() through URLs browsers read differently.
Fixed in 7.4.12 and 6.4.40 · 1 older release
-
medium Symfony · · Reviewed
Symfony HtmlSanitizer: Direction Marks in URLs Let Links Look Like Others
Lets sanitized links carry Unicode direction marks that make a link's shown address differ from where it really goes.
Fixed in 7.4.12 and 6.4.40 · 1 older release
-
medium Symfony · · Reviewed
Symfony Mailer Mailtrap: Webhook Signatures Are Never Checked
Lets anyone send fake delivery, bounce or click events to apps that use the Mailtrap webhook parser, even with a secret set.
Fixed in 7.4.12 · 1 older release
-
high Symfony · · Reviewed
Symfony X509 Login: Crafted Certificate Names Can Pose as Another User
Lets a client certificate holder log in as another user by hiding an email in the certificate name, in apps using X509Authenticator.
Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release
-
medium Symfony · · Reviewed
Symfony Routing: Loose Route Requirements Let Links Point Off-Site
Lets a crafted parameter value pass a route requirement written as a list of options, so path() or url() builds a link to another host.
Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release
-
medium Symfony · · Reviewed
Symfony Runtime: Web Requests Can Still Switch APP_ENV and APP_DEBUG
Lets an unauthenticated request change the app environment or debug mode on servers with register_argc_argv=On, bypassing the CVE-2024-50340 fix.
Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release
-
high Symfony · · Reviewed
Symfony Mime: Line Breaks in Addresses Allow Email Header Injection
Lets an attacker add email headers or SMTP commands through a crafted address in apps that pass user addresses to Symfony Mailer.
Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release
-
medium Symfony · · Reviewed
Symfony Security CAS: Tickets From Other Services Can Log In as the User
Lets an attacker who runs another app on the same CAS server log in as a victim, in apps using Cas2Handler without trusted_hosts.
Fixed in 7.4.12 · 1 older release
-
low Symfony · · Reviewed
Symfony Yaml: Deeply Nested YAML Crashes the Process
Lets an attacker crash the PHP worker with one deeply nested YAML document in apps that parse untrusted YAML.
Fixed in 7.4.12, 6.4.40 and 5.4.52 · 1 older release
-
low Symfony · · Reviewed
Symfony Profiler: Stored Cross-Site Scripting in File Excerpts
Lets someone who can write to a project file, like a log, run script in a developer's browser when they view it in the profiler.
Fixed in 7.4.12 and 6.4.40 · 1 older release
-
high Symfony · · Reviewed
Symfony Security: HEAD Requests Skip Checks Limited to GET
Lets HEAD requests skip #[IsGranted], #[IsSignatureValid] and #[IsCsrfTokenValid] checks that set methods: ['GET'].
Fixed in 7.4.12 · 1 older release
-
high Symfony Twig · · Reviewed
Twig: Code Execution Through Dynamic Macro References on _self
Lets anyone who can write a template run PHP code on the server, bypassing even a strict sandbox, in Twig 3.15 to 3.25.
Fixed in 3.26.0
-
low Symfony Twig · · Reviewed
Twig: spaceless Filter Output Skips Autoescaping
Can allow cross-site scripting when templates apply the deprecated spaceless filter to user input with autoescape on.
Fixed in 3.26.0
-
critical Symfony Twig · · Reviewed
Twig: Code Execution Through a Crafted {% use %} Template Name
Lets anyone who can write a template, even a sandboxed one, run PHP code on the server through the {% use %} tag.
Fixed in 3.26.0
-
low Symfony Twig · · Reviewed
Twig Profiler: Cross-Site Scripting in HtmlDumper Output
Lets attacker-controlled template names inject HTML into Twig profiler dumps rendered with HtmlDumper.
Fixed in 3.26.0
-
high Symfony Twig · · Reviewed
Twig Sandbox: Object Destructuring Skips Property and Method Checks
Lets a sandboxed template read any public property or call any public getter through object destructuring, in Twig 3.24 and 3.25.
Fixed in 3.26.0
-
low Symfony Twig · · Reviewed
Twig Sandbox: Untrusted Templates Can Use Unlimited CPU and Memory
Allows a sandboxed Twig template to use as much CPU, memory and time as it likes; Twig now documents limiting this at the process level.
Fixed in 3.26.0
-
low Symfony Twig · · Reviewed
Twig Sandbox: column Filter Reads Blocked Object Properties
Lets an untrusted template read object properties the sandbox policy blocks, when the column filter is allowed.
Fixed in 3.26.0
-
medium Symfony Twig · · Reviewed
Twig Sandbox: {% sandbox %} Include Skips Checks on Cached Templates
Lets an included template use any tag, filter or function if it was loaded outside the sandbox first, through the {% sandbox %} tag.
Fixed in 3.26.0
-
high Symfony Twig · · Reviewed
Twig Sandbox: Callback Filters Accept Any PHP Callable Under a Source Policy
Lets a sandboxed template pass any PHP callable to sort, filter, map or reduce when the sandbox is set by a source policy.
Fixed in 3.26.0 · 1 older release
-
high Symfony Twig · · Reviewed
Twig Sandbox: Several Ways to Call Blocked __toString() Methods
Lets an untrusted template call __toString() on objects the sandbox policy blocks, through operators and expressions the sandbox didn't check.
Fixed in 3.26.0
-
medium Symfony Twig · · Reviewed
Twig Sandbox: template_from_string Escapes a Source Policy Sandbox
Lets a sandboxed template run any tag, filter or function when the sandbox is set by a source policy and template_from_string is allowed.
Fixed in 3.26.0
-
low Symfony Twig · · Reviewed
Twig Extras: Some Filters Skip Escaping in Every Context
Can allow cross-site scripting when output from filters like html_to_markdown or markdown_to_html is used in templates without escaping.
Fixed in 3.26.0
-
low Symfony Twig · · Reviewed
Twig Intl Extra: Formatter Cache Can Grow Without Limit
Lets a template use up memory outside memory_limit by passing many distinct formats to Twig's intl filters, mainly on long-running workers.
Fixed in 3.26.0
-
medium Symfony · · Reviewed
Symfony Process on Windows: Git Bash Can Mangle Arguments and Hit Wrong Paths
Can make file commands run through Symfony Process act on the wrong path, up to deleting a whole directory, when PHP runs from Git Bash.
Fixed in 7.4.5, 6.4.33 and 5.4.51 · 2 older releases
-
high Symfony · · Reviewed
Symfony HttpFoundation: Malformed Paths Can Slip Past Access Rules
Lets an attacker reach some URLs that path-based access rules should block, in apps whose rules assume every path starts with a slash.
Fixed in 6.4.29 and 5.4.50 · 1 older release
-
medium Symfony Symfony UX · · Reviewed
Symfony UX Twig Components: Unescaped Attributes Allow XSS
Lets an attacker inject HTML and script into pages that render component attributes holding user input with {{ attributes }}.
Fixed in 2.25.1
-
medium Symfony Twig · · Reviewed
Twig: Null Coalesce Operator Skips Output Escaping
Leaves the left side of a ?? expression unescaped in Twig templates, so user input there can carry HTML or script into the page.
Fixed in 3.19.0
-
high Symfony · · Reviewed
Symfony Remember-Me: Persistent Tokens Let a User Log In as Someone Else
Lets someone with a valid remember-me token log in as a different user in Symfony apps that store remember-me tokens with a token provider.
Fixed in 6.4.15 and 5.4.47 · 1 older release
-
low Symfony · · Reviewed
Symfony HttpClient: NoPrivateNetworkHttpClient Leaks Internal Hosts and Ports
Can let an attacker map internal IP addresses and ports through apps that fetch user-supplied URLs with NoPrivateNetworkHttpClient.
Fixed in 6.4.15 and 5.4.47 · 1 older release
-
low Symfony Twig · · Reviewed
Twig Sandbox: __toString() Runs on Objects in Arrays Without a Check
Lets untrusted templates call __toString() on objects the sandbox policy blocks, when the object sits in an array or an argument list.
Fixed in 3.14.1 · 1 older release
-
low Symfony Twig · · Reviewed
Twig Sandbox: Array-Like Objects Skip the Security Policy
Lets untrusted templates read properties of ArrayAccess objects that the sandbox policy should block, in apps that run user templates in Twig's sandbox.
Fixed in 3.14.1 · 1 older release
-
low Symfony · · Reviewed
Symfony HttpFoundation: Malformed URLs Can Slip Past Redirect Checks
Lets an attacker send users to another domain when an app checks redirect targets with the Request class, which parsed some URLs unlike browsers.
Fixed in 6.4.14 and 5.4.46 · 1 older release
-
high Symfony · · Reviewed
Symfony Process on Windows: A cmd.exe in the Working Directory Gets Run
Lets a cmd.exe file in the current working directory run instead of the real one when Symfony's Process class runs commands on Windows.
Fixed in 6.4.14 and 5.4.46 · 1 older release
-
medium Symfony · · Reviewed
Symfony Runtime: Query Strings Can Change the Environment and Debug Mode
Lets anyone switch the environment or debug mode of a Symfony app for a request, on servers where PHP's register_argc_argv is On.
Fixed in 6.4.14 and 5.4.46 · 1 older release
-
medium Symfony Twig ·
Fixed in 3.14.0 and 2.16.0 · 2 older releases
-
low Symfony · · Reviewed
Symfony Validator: Values Ending in a Newline Pass Regex-Based Checks
Lets values with a trailing newline pass constraints such as Email, Url, Date and Time that Symfony checks with a regular expression.
Fixed in 6.4.11 and 5.4.43 · 1 older release
-
low Symfony · · Reviewed
Symfony Security::login() Skips the Firewall's Custom User Checker
Lets accounts a firewall's custom user_checker would reject log in anyway when the app logs them in with Security::login().
Fixed in 6.4.10 · 2 older releases
-
medium Symfony · · Reviewed
Symfony2 getClientIp(): Faked Client IPs Can Get Past IP-Based Access Rules
Lets a client fake their IP address in Symfony 2.0 and 2.1 apps that call Request::trustProxyData() and use getClientIp() for access control.
Only affects branches that no longer get security fixes
-
high Symfony · · Reviewed
Symfony 2.0: XML Entity Expansion Lets Small Documents Exhaust Memory
Lets an attacker use up a server's memory with one small XML document in Symfony 2.0 apps that parse untrusted XML.
Only affects branches that no longer get security fixes
-
medium Symfony · · Reviewed
Symfony Webhook: WebhookController Error Message Allows XSS
Lets an attacker craft a link that runs JavaScript on your site through the Webhook component's error response, in Symfony 6.3 before 6.3.8.
Only affects branches that no longer get security fixes
-
medium Symfony · · Reviewed
Symfony Security: Session ID Not Renewed When a Partial Login Completes
Allows session fixation, because the session ID wasn't regenerated when a partly authenticated login became fully authenticated.
Fixed in 5.4.31 · 1 older release
-
medium Symfony · · Reviewed
Symfony Twig Bridge: CodeExtension Filters Can Output Unescaped HTML
Allows cross-site scripting when untrusted input reaches some CodeExtension Twig filters, which marked their output safe without escaping it.
Fixed in 5.4.31 · 2 older releases
-
medium Symfony Symfony UX ·
symfony/ux-autocomplete Prevent injection of invalid entity ids for "autocomplete" fields
Fixed in 2.11.2
-
medium Symfony ·
CVE-2022-24894: Prevent storing cookie headers in HttpCache
Fixed in 5.4.20 · 4 older releases
-
medium Symfony ·
CVE-2022-24895: Possible CSRF token fixation
Fixed in 5.4.20 · 4 older releases
-
high Symfony Twig ·
Possibility to load a template outside a configured directory when using the filesystem loader
Fixed in 3.4.3 and 2.15.3 · 1 older release
-
high Symfony ·
No fixed release listed yet
-
high Symfony Twig ·
Disallow non closures in the sort filter
Fixed in 3.3.8 and 2.14.11
-
high Symfony ·
CVE-2022-23601: CSRF token missing in forms
Fixed in 5.4.4 · 2 older releases
-
medium Symfony ·
CVE-2021-41270: Prevent CSV Injection via formulas
Only affects branches that no longer get security fixes
-
medium Symfony ·
CVE-2021-41268: Remember me cookie persistance after password changes
Only affects branches that no longer get security fixes
-
medium Symfony ·
CVE-2021-41267: Webcache Poisoning via X-Forwarded-Prefix and sub-request
Only affects branches that no longer get security fixes
-
medium Symfony ·
CVE-2021-32693: Authentication granted to all firewalls instead of just one
Only affects branches that no longer get security fixes
-
medium Symfony MakerBundle ·
CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms
Fixed in 1.31.1 · 7 older releases
-
high Symfony ·
CVE-2020-15094: Prevent RCE when calling untrusted remote with CachingHttpClient
Only affects branches that no longer get security fixes
-
low Symfony ·
CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header
Only affects branches that no longer get security fixes
-
medium Symfony ·
CVE-2020-5274: Fix Exception message escaping rendered by ErrorHandler
Only affects branches that no longer get security fixes
-
high Symfony ·
Only affects branches that no longer get security fixes
-
high Symfony ·
CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser
Only affects branches that no longer get security fixes
-
critical Symfony ·
CVE-2019-11325: Fix escaping of strings in VarExporter
Only affects branches that no longer get security fixes
-
high Symfony ·
CVE-2019-18887: Use constant time comparison in UriSigner
Only affects branches that no longer get security fixes
-
medium Symfony ·
CVE-2019-18886: Prevent user enumeration using switch user functionality
Only affects branches that no longer get security fixes
-
critical Symfony ·
CVE-2019-18889: Forbid serializing AbstractAdapter and TagAwareAdapter instances
Only affects branches that no longer get security fixes
-
critical Symfony ·
CVE-2019-10910: Check service IDs are valid
Only affects branches that no longer get security fixes
-
medium Symfony ·
CVE-2019-10909: Escape validation messages in the PHP templating engine
Fixed in 8.6.14 and 7.65 · 6 older releases
-
high Symfony ·
CVE-2019-10912: Prevent destructors with side-effects from being unserialized
Only affects branches that no longer get security fixes
-
high Symfony ·
CVE-2019-10911: Add a separator in the remember me cookie hash
Only affects branches that no longer get security fixes
-
critical Symfony ·
CVE-2019-10913: Reject invalid HTTP method overrides
Only affects branches that no longer get security fixes
-
low Symfony Twig ·
Sandbox Information Disclosure
Fixed in 2.7.0 and 1.38.0
-
medium Symfony ·
CVE-2018-19790: Open Redirect Vulnerability on login
Only affects branches that no longer get security fixes
-
medium Symfony ·
CVE-2018-19789: Temporary uploaded file path disclosure
Only affects branches that no longer get security fixes
-
medium Symfony ·
CVE-2018-14773: Remove support for legacy and risky HTTP headers
Only affects branches that no longer get security fixes
-
critical Symfony ·
CVE-2018-11407: Unauthorized access on a misconfigured LDAP server when using an empty password
Only affects branches that no longer get security fixes
-
medium Symfony ·
CVE-2018-11386: Denial of service when using PDOSessionHandler
Only affects branches that no longer get security fixes
-
high Symfony ·
CVE-2018-11406: CSRF Token Fixation
Only affects branches that no longer get security fixes
-
high Symfony ·
CVE-2018-11385: Session Fixation Issue for Guard Authentication
Only affects branches that no longer get security fixes
-
medium Symfony ·
CVE-2018-11408: Open redirect vulnerability on security handlers
Only affects branches that no longer get security fixes
-
high Symfony ·
CVE-2017-16654: Intl bundle readers breaking out of paths
Only affects branches that no longer get security fixes
-
medium Symfony ·
CVE-2017-16652: Open redirect vulnerability on security handlers
Only affects branches that no longer get security fixes
-
medium Symfony ·
CVE-2017-16790: Ensure that submitted data are uploaded files
Only affects branches that no longer get security fixes
-
medium Symfony ·
CVE-2017-16653: CSRF protection does not use different tokens for HTTP and HTTPS
Only affects branches that no longer get security fixes
-
critical Symfony ·
CVE-2017-11365: Empty passwords validation issue
Only affects branches that no longer get security fixes
-
critical Symfony ·
CVE-2016-2403: Unauthorized access on a misconfigured Ldap server when using an empty password
Only affects branches that no longer get security fixes
-
high Symfony ·
CVE-2016-4423: Large username storage in session
Only affects branches that no longer get security fixes
-
high Symfony ·
CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails
Only affects branches that no longer get security fixes
-
low Symfony ·
CVE-2015-8124: Session Fixation in the "Remember Me" Login Feature
Only affects branches that no longer get security fixes
-
high Symfony ·
CVE-2015-8125: Potential Remote Timing Attack Vulnerability in Security Remember-Me Service
Only affects branches that no longer get security fixes
-
high Symfony Twig ·
Remote code execution in templates
Fixed in 1.20.0
-
medium Symfony ·
CVE-2015-4050: ESI unauthorized access
Only affects branches that no longer get security fixes
-
medium Symfony ·
Unsafe methods in the Request class
Only affects branches that no longer get security fixes
-
medium Symfony ·
Only affects branches that no longer get security fixes
-
high Symfony ·
CSRF vulnerability in the Web Profiler
Only affects branches that no longer get security fixes
-
high Symfony ·
Direct access of ESI URLs behind a trusted proxy
Only affects branches that no longer get security fixes
-
medium Symfony ·
Security issue when parsing the Authorization header
Only affects branches that no longer get security fixes
-
high Symfony ·
Denial of service with a malicious HTTP Host header
Only affects branches that no longer get security fixes
-
high Symfony ·
Code injection in the way Symfony implements translation caching in FrameworkBundle
Only affects branches that no longer get security fixes
-
medium Symfony ·
Possible DOS attack with long user-submitted passwords
Only affects branches that no longer get security fixes
-
medium Symfony ·
Only affects branches that no longer get security fixes
-
high Symfony ·
Validation metadata serialization and loss of information
Only affects branches that no longer get security fixes
-
medium Symfony Twig ·
Vulnerability in the filesystem loader
Fixed in 1.12.3
-
high Symfony ·
Ability to enable/disable object support in YAML parsing and dumping
Only affects branches that no longer get security fixes
-
high Symfony ·
Ability to enable/disable PHP parsing in Yaml::parse()
Only affects branches that no longer get security fixes
-
medium Symfony ·
Code execution vulnerability via the "internal" routes
Only affects branches that no longer get security fixes
-
critical Symfony ·
Request::getClientIp() when the trust proxy mode is enabled
Only affects branches that no longer get security fixes
-
medium Symfony ·
Routes behind a firewall are accessible even when not logged in
Only affects branches that no longer get security fixes
-
critical Symfony ·
XML decoding attack vector through external entities
Only affects branches that no longer get security fixes
-
medium Symfony ·
Vulnerability in the EntityUserProvider as provided in the Doctrine bridge
Only affects branches that no longer get security fixes