PHP security advisories

Symfony Security: HEAD Requests Skip access_control Rules Limited to GET

Lets HEAD requests reach pages that access_control rules or firewalls protect only for GET, running the controller without the check.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony X509 Login: Crafted Certificate Names Can Log In as Another User

Lets a client certificate holder log in as another user's email address in apps that use Symfony's X509 authenticator.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony Serializer: Fake UploadedFile Data Can Point at Any Server File

Lets a client make an app treat any server file as an upload in apps that deserialize request data into UploadedFile properties.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony Routing: Host Placeholders Can Bypass Path-Based Access Rules

Lets requests reach controllers that path-based access_control rules protect, in apps with routes that use host placeholders.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony Yaml: Small Documents Can Tie Up the Parser for Minutes

Lets an attacker keep a PHP worker busy with one small YAML document in apps that parse untrusted YAML, including some #[MapRequestPayload] endpoints.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony Serializer: Data URIs Can Read Any File on the Server

Lets a client read any file PHP can read in apps that deserialize client data into SplFileObject, SplFileInfo or File properties.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony HttpClient: Scoped Client Can Send Credentials to Other Hosts

Can send a scoped client's token or other credentials to another host when an attacker controls the start of a URL the app requests.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony Filesystem: Crafted Paths Can Escape Their Base Directory

Lets an attacker read or write files outside an allowed folder in apps that check user paths with Path, and lets packages write outside assets/vendor.

Fixed in 8.1.11, 7.4.23, 6.4.50 and 5.4.56

Symfony HttpFoundation: Crafted Cache-Control Header Ties Up the CPU

Lets an unauthenticated attacker burn close to a second of CPU per request with a crafted Cache-Control header, in any app built on HttpFoundation.

Fixed in 8.1.7, 7.4.19, 6.4.46 and 5.4.54

Composer: Malicious Package Can Run Commands via a Perforce Source URL

Lets a malicious package run commands during composer install on machines with the p4 client, when it comes from a repository other than Packagist.org.

Fixed in 2.10.3 · 1 older release

Symfony Yaml: Deeply Nested Inline YAML Crashes the Process

Lets an attacker crash the PHP process with one YAML document in apps that parse untrusted YAML, including some #[MapRequestPayload] endpoints.

Fixed in 8.1.6, 7.4.18, 6.4.45 and 5.4.54

Guzzle: Oddly Written Hosts Can Slip Past Host-Based Checks

Lets an attacker reach hosts an app meant to block, such as loopback, when the app builds Guzzle request URLs from user input and checks the host first.

Fixed in 8.0.1 and 7.15.2

Composer: Malicious Package Name Can Write Files Outside Vendor

Lets a malicious package from a third-party repository write files anywhere the Composer user can, which can lead to running code.

Fixed in 2.10.2 · 1 older release

Twig Sandbox: Allow-List Bypass When Sandbox State Changes

Lets an untrusted template use forbidden filters, tags and functions when one Twig environment renders both sandboxed and normal templates.

No fixed release listed yet

Symfony UX Toolkit: Malicious Kit Can Read and Write Any File

Lets a crafted or compromised recipe kit read or overwrite files outside the project when you run ux:install, which can lead to running code.

Fixed in 3.2.0 and 2.36.1

Laravel Email Rule: Header Injection Into Outgoing Mail

Lets an unauthenticated attacker interfere with outgoing email in Laravel apps that send mail to addresses users supply.

Fixed in 12.60.0

Twig Sandbox: Allow-List Bypass When Sandbox State Changes

Lets an untrusted template use forbidden filters, tags and functions when one Twig environment renders both sandboxed and normal templates.

Fixed in 3.27.0

Symfony Security: failure_forward Lets Anyone Reach Protected Pages

Lets an unauthenticated user load access_control-protected GET routes in apps that use form login with failure_forward turned on.

Fixed in 7.4.13, 6.4.41 and 5.4.53 · 1 older release