HighGHSA-3rg7-wf37-54rmCVE-2025-64500

Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

Published 12 Nov 2025 · Updated 10 Sept 2026

Affected packages

symfony/http-foundationComposer

Affected: <5.4.50
Fixed in: 5.4.50

Update to the fixed version for your release line, for example:composer require symfony/http-foundation:^5.4.50

symfony/http-foundationComposer

Affected: >=6.0.0 <6.4.29
Fixed in: 6.4.29

Update to the fixed version for your release line, for example:composer require symfony/http-foundation:^6.4.29

symfony/http-foundationComposer

Affected: >=7.0.0 <7.3.7
Fixed in: 7.3.7

Update to the fixed version for your release line, for example:composer require symfony/http-foundation:^7.3.7

symfony/symfonyComposer

Affected: >=2.0.0 <5.4.50
Fixed in: 5.4.50

Update to the fixed version for your release line, for example:composer require symfony/symfony:^5.4.50

symfony/symfonyComposer

Affected: >=6.0.0 <6.4.29
Fixed in: 6.4.29

Update to the fixed version for your release line, for example:composer require symfony/symfony:^6.4.29

symfony/symfonyComposer

Affected: >=7.0.0 <7.3.7
Fixed in: 7.3.7

Update to the fixed version for your release line, for example:composer require symfony/symfony:^7.3.7

Details

Description

The Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption.

Resolution

The Request class now ensures that URL paths always start with a /.

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.

Is GHSA-3rg7-wf37-54rm in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/http-foundation, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.