CVE-2025-64500
High · 7.3CVSS
7.3
EPSS
1.4%
Published
Nov 12, 2025
CISA due date
—
The record
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | symfony/http-foundation | 0 | 5.4.50 |
| Packagist | symfony/http-foundation | 6.0.0 | 6.4.29 |
| Packagist | symfony/http-foundation | 7.0.0 | 7.3.7 |
| Packagist | symfony/symfony | 2.0.0 | 5.4.50 |
| Packagist | symfony/symfony | 6.0.0 | 6.4.29 |
| Packagist | symfony/symfony | 7.0.0 | 7.3.7 |
| Chainguard | nextcloud-server-30-apache2-config | 0 | 30.0.17-r0 |
| Chainguard | nextcloud-server-31 | 0 | 31.0.11-r0 |
| Chainguard | nextcloud-server-31-apache2-config | 0 | 31.0.11-r0 |
| Chainguard | nextcloud-server-32 | 0 | 32.0.2-r0 |
| Chainguard | nextcloud-server-32-apache2-config | 0 | 32.0.2-r0 |
| Wolfi | nextcloud-server-31 | 0 | 31.0.11-r0 |
| Wolfi | nextcloud-server-31-apache2-config | 0 | 31.0.11-r0 |
| Wolfi | nextcloud-server-32 | 0 | 32.0.2-r0 |
| Wolfi | nextcloud-server-32-apache2-config | 0 | 32.0.2-r0 |
| packagist | symfony/http-foundation | 6.0.0 | 6.4.29 |
| packagist | symfony/http-foundation | 7.0.0 | 7.3.7 |
| packagist | symfony/symfony | 2.0.0 | 5.4.50 |
| packagist | symfony/symfony | 6.0.0 | 6.4.29 |
| packagist | symfony/symfony | 7.0.0 | 7.3.7 |
Related vulnerabilities
- CVE-2024-50345 Symfony vulnerable to open redirect via browser-sanitized URLs Also affects symfony/http-foundation
- CVE-2026-24739 Symfony is a PHP framework for web and console applications and a set of reusable PHP… Also affects symfony/symfony
- CVE-2024-50343 symfony/validator is a module for the Symphony PHP framework which provides tools to… Also affects symfony/symfony
- CVE-2024-50340 symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP… Also affects symfony/symfony
- CVE-2024-50341 symfony/security-bundle is a module for the Symphony PHP framework which provides a tight… Also affects symfony/symfony
- CVE-2024-50342 Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient Also affects symfony/symfony
- CVE-2025-14761 Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write… Also affects nextcloud-server-30-apache2-config
- CVE-2025-66552 Nextcloud Server admin_audit does not log all actions on files in groupfolders Also affects nextcloud-server-30-apache2-config