p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in symfony/symfony · Seite 2

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für symfony/symfony: 2. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 102

  1. CVE-2026-45063

    Kritisch · CVSS 9.1EPSS 0,37%Korrektur verfügbar

    Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

    symfony/symfony symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 5.4.52 aktualisieren
    • Auf 6.4.40 aktualisieren
    • Auf 7.4.12 aktualisieren
    • Auf 8.0.12 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-45070

    Mittel · CVSS 6.3EPSS 0,39%Korrektur verfügbar

    Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Mime\Header\ParameterizedHeader validates and encodes parameter values but emits parameter names verbatim, allowing a caller that derives a parameter name from untrusted input to include CRLF or other non-token bytes and inject additional headers into rendered structured mail headers such as Content-Type or Content-Disposition. This issue is reported as fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

    symfony/symfony symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 5.4.52 aktualisieren
    • Auf 6.4.40 aktualisieren
    • Auf 7.4.12 aktualisieren
    • Auf 8.0.12 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-45073

    Mittel · CVSS 6.3EPSS 0,46%Korrektur verfügbar

    Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion scope. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

    symfony/symfony symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 5.4.52 aktualisieren
    • Auf 6.4.40 aktualisieren
    • Auf 7.4.12 aktualisieren
    • Auf 8.0.12 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-45753

    Niedrig · CVSS 2.1EPSS 0,34%Korrektur verfügbar

    Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes() omits URL-valued attributes including action, formaction, poster, and cite, so configurations that admit those attributes can leave javascript: URIs unsanitized and enable XSS when the resulting HTML is rendered or a victim submits a form or clicks a button. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

    symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 6.4.40 aktualisieren
    • Auf 7.4.12 aktualisieren
    • Auf 8.0.12 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-45072

    Niedrig · CVSS 2EPSS 0,3%Korrektur verfügbar

    Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler file_excerpt Twig filter escapes PHP files through highlight_string() but interpolates lines from non-PHP files directly into <code> elements, allowing stored XSS against a developer who opens an attacker-written file such as var/log/dev.log in the profiler. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

    symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 6.4.40 aktualisieren
    • Auf 7.4.12 aktualisieren
    • Auf 8.0.12 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-45756

    Hoch · CVSS 8.2EPSS 0,63%Korrektur verfügbar

    Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match() and search() filter patterns directly into preg_match() without a length cap, i-regexp restriction, or bounded backtracking, allowing catastrophic-backtracking expressions to pin worker CPU and cause denial of service. This issue is fixed in versions 7.4.12 and 8.0.12.

    symfony/symfony symfony/symfonyPHP
    • Auf 7.4.12 aktualisieren
    • Auf 8.0.12 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-45066

    Niedrig · CVSS 2.3EPSS 0,34%Korrektur verfügbar

    Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts() or allowMediaHosts() because UrlSanitizer::parse() follows RFC 3986 while browsers follow WHATWG URL parsing, and because <area href> is checked against the media policy rather than the link policy. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

    symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 6.4.40 aktualisieren
    • Auf 7.4.12 aktualisieren
    • Auf 8.0.12 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-45074

    Hoch · CVSS 7.6EPSS 0,49%Korrektur verfügbar

    Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.

    symfony/symfony symfony/symfonyPHP
    • Auf 7.4.12 aktualisieren
    • Auf 8.0.12 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-45077

    Hoch · CVSS 8.3EPSS 0,67%Korrektur verfügbar

    Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with unserialize(base64_decode($message)) without authentication, integrity checks, or an allowed_classes allowlist, allowing any reachable host to submit attacker-chosen serialized PHP payloads that can crash the listener and may trigger object-injection gadget effects. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

    symfony/symfony symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 5.4.52 aktualisieren
    • Auf 6.4.40 aktualisieren
    • Auf 7.4.12 aktualisieren
    • Auf 8.0.12 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-45065

    Niedrig · CVSS 2.3EPSS 0,35%Korrektur verfügbar

    Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route parameters against a pattern built as ^ plus the raw requirement plus $; with ungrouped alternations, middle alternatives match as unanchored substrings, allowing a value such as //evil.com to satisfy a common locale requirement and generate a protocol-relative off-site URL. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

    symfony/symfony symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 5.4.52 aktualisieren
    • Auf 6.4.40 aktualisieren
    • Auf 7.4.12 aktualisieren
    • Auf 8.0.12 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2026-45067

    Mittel · CVSS 6.3EPSS 0,6%Korrektur verfügbar

    Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

    ### Description `Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email addresses whose local-part (the part before `@`) is an RFC-5322 *quoted string* containing raw `\r\n` bytes — e.g. `"x\r\nBcc: attacker@evil"@example.com`. The stored address is later emitted verbatim into (1) the rendered message headers and (2) `SmtpTransport`'s `MAIL FROM:<...>` / `RCPT TO:<...>` protocol lines, turning the embedded CRLF in

    symfony/symfony symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 5.4.52 aktualisieren
    • Auf 6.4.40 aktualisieren
    • Auf 7.4.12 aktualisieren
    • Auf 8.0.12 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-24739

    Mittel · CVSS 6.3EPSS 0,23%Korrektur verfügbar

    Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operations

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.51, 6.4.33, 7.3.11, 7.4.5, and 8.0.5, the Symfony Process component did not correctly treat some characters (notably `=`) as “special” when escaping arguments on Windows. When PHP is executed from an MSYS2-based environment (e.g. Git Bash) and Symfony Process spawns native Windows executables, MSYS2’s argument/path conversion can mis-handle unquoted arguments containing these characters. This can cause the spawned process to receive corrupted/truncated arguments compared to what Symfony intended. If an application (or toolin

    symfony/symfony symfony/symfony symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 5.4.51 aktualisieren
    • Auf 6.4.33 aktualisieren
    • Auf 7.3.11 aktualisieren
    • Auf 7.4.5 aktualisieren
    • Auf 8.0.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2025-64500

    Hoch · CVSS 7.3EPSS 1,41%Öffentlicher ExploitKorrektur verfügbar

    Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.

    symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 5.4.50 aktualisieren
    • Auf 6.4.29 aktualisieren
    • Auf 7.3.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2024-50340

    Hoch · CVSS 7.3EPSS 61,83%Öffentlicher ExploitKorrektur verfügbar

    Ability to change environment from query in symfony/runtime

    symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.

    symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 5.4.46 aktualisieren
    • Auf 6.4.14 aktualisieren
    • Auf 7.1.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2024-50341

    Niedrig · CVSS 3.1EPSS 0,31%Korrektur verfügbar

    Security::login does not take into account custom user_checker in symfony/security-bundle

    symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All users are advised to upgrade. There are no known workarounds for this vulnerability.

    symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 6.4.10 aktualisieren
    • Auf 7.0.10 aktualisieren
    • Auf 7.1.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2024-50342

    Niedrig · CVSS 3.1EPSS 0,47%Korrektur verfügbar

    Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client

    symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.

    symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 5.4.47 aktualisieren
    • Auf 6.4.15 aktualisieren
    • Auf 7.1.8 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2024-50343

    Niedrig · CVSS 3.1EPSS 0,46%Korrektur verfügbar

    Incorrect response from Validator when input ends with `\n` in symfony/validator

    symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 5.4.43 aktualisieren
    • Auf 6.4.11 aktualisieren
    • Auf 7.1.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2024-51736

    Niedrig · CVSS 0EPSS 0,43%Korrektur verfügbar

    Command execution hijack on Windows with Process class in symfony/process

    Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 5.4.46 aktualisieren
    • Auf 6.4.14 aktualisieren
    • Auf 7.1.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  19. CVE-2014-6072

    Hoch · CVSS 8.1Korrektur verfügbar

    Symfony Cross-Site Request Forgery vulnerability in the Web Profiler

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony WebProfiler bundle are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore. ### Description The Symfony Web Profiler is a great development tool, but it should not be enabled on production servers. If it is enabled in production, it must be properly secured so that only authorized people have access to it. Developers must be very cautious about this as the Web Profiler gives many sensitive information about a Symfony project and a

    symfony/symfony symfony/symfony symfony/symfonyPHP
    • Auf 2.3.19 aktualisieren
    • Auf 2.4.9 aktualisieren
    • Auf 2.5.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. GHSA-hx53-jchx-cr52

    Mittel · CVSS 5.9Korrektur verfügbar

    Symfony2 improper IP based access control

    Damien Tournoud, from the Drupal security team, contacted us two days ago about a security issue in the Request::getClientIp() method when the trust proxy mode is enabled (Request::trustProxyData()). An application is vulnerable if it uses the client IP address as returned by the Request::getClientIp() method for sensitive decisions like IP based access control. To fix this security issue, the following changes have been made to all versions of Symfony2: A new Request::setTrustedProxies() method has been introduced and should be used intead of Request::trustProxyData() to enable the trust proxy mode. It takes an array of trusted proxy IP a

    symfony/symfony symfony/symfonyPHP
    • Auf 2.0.19 aktualisieren
    • Auf 2.1.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →