Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2025-64500
Analyzed
More InfoOfficial Page
Source-security-advisories@github.com
View Known Exploited Vulnerability (KEV) details
Published At-12 Nov, 2025 | 22:15
Updated At-12 Jan, 2026 | 17:49

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.17.3HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Type: Secondary
Version: 3.1
Base score: 7.3
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CPE Matches

sensiolabs
sensiolabs
>>httpfoundation>>Versions from 2.0.0(inclusive) to 5.4.50(exclusive)
cpe:2.3:a:sensiolabs:httpfoundation:*:*:*:*:*:*:*:*
sensiolabs
sensiolabs
>>httpfoundation>>Versions from 6.0.0(inclusive) to 6.4.29(exclusive)
cpe:2.3:a:sensiolabs:httpfoundation:*:*:*:*:*:*:*:*
sensiolabs
sensiolabs
>>httpfoundation>>Versions from 7.0.0(inclusive) to 7.3.7(exclusive)
cpe:2.3:a:sensiolabs:httpfoundation:*:*:*:*:*:*:*:*
sensiolabs
sensiolabs
>>symfony>>Versions from 2.0.0(inclusive) to 5.4.50(exclusive)
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
sensiolabs
sensiolabs
>>symfony>>Versions from 6.0.0(inclusive) to 6.4.29(exclusive)
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
sensiolabs
sensiolabs
>>symfony>>Versions from 7.0.0(inclusive) to 7.3.7(exclusive)
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-647Secondarysecurity-advisories@github.com
CWE ID: CWE-647
Type: Secondary
Source: security-advisories@github.com
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2025-64500.yamlsecurity-advisories@github.com
Third Party Advisory
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2025-64500.yamlsecurity-advisories@github.com
Third Party Advisory
https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cacsecurity-advisories@github.com
Patch
https://github.com/symfony/symfony/security/advisories/GHSA-3rg7-wf37-54rmsecurity-advisories@github.com
Vendor Advisory
https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypasssecurity-advisories@github.com
Third Party Advisory
Hyperlink: https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2025-64500.yaml
Source: security-advisories@github.com
Resource:
Third Party Advisory
Hyperlink: https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2025-64500.yaml
Source: security-advisories@github.com
Resource:
Third Party Advisory
Hyperlink: https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/symfony/symfony/security/advisories/GHSA-3rg7-wf37-54rm
Source: security-advisories@github.com
Resource:
Vendor Advisory
Hyperlink: https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass
Source: security-advisories@github.com
Resource:
Third Party Advisory
Change History
0Changes found

Details not found