CVE-2025-64500
📋 TL;DR
This vulnerability in Symfony's HttpFoundation component allows attackers to bypass access control rules by manipulating URL paths that don't start with a forward slash. It affects Symfony applications using the Request class for authorization checks. All Symfony applications from version 2.0.0 up to (but not including) 5.4.50, 6.4.29, and 7.3.7 are vulnerable.
💻 Affected Systems
- Symfony
- Symfony HttpFoundation component
📦 What is this software?
Httpfoundation by Sensiolabs
Httpfoundation by Sensiolabs
Httpfoundation by Sensiolabs
Symfony by Sensiolabs
Symfony by Sensiolabs
Symfony by Sensiolabs
⚠️ Risk & Real-World Impact
Worst Case
Complete authorization bypass allowing unauthorized access to protected resources, administrative functions, or sensitive data.
Likely Case
Limited authorization bypass affecting specific endpoints where access control relies on path prefix checks.
If Mitigated
Minimal impact if applications implement additional security layers beyond path-based authorization.
🎯 Exploit Status
Exploitation requires crafting HTTP requests with specific PATH_INFO values. No authentication needed if vulnerable endpoints are publicly accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.4.50, 6.4.29, or 7.3.7
Vendor Advisory: https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass
Restart Required: No
Instructions:
1. Update Symfony using Composer: composer require symfony/http-foundation:^5.4.50 (or appropriate version). 2. Run composer update. 3. Clear cache: php bin/console cache:clear. 4. Test application functionality.
🔧 Temporary Workarounds
Custom Request Path Normalization
allAdd middleware to normalize all request paths to start with forward slash before authorization checks.
Create custom middleware that modifies $request->getPathInfo() to ensure it starts with '/'
🧯 If You Can't Patch
- Implement additional authorization checks that don't rely solely on path prefixes
- Use web application firewall (WAF) rules to block requests with malformed PATH_INFO
🔍 How to Verify
Check if Vulnerable:
Check composer.json or composer.lock for Symfony version. If using Symfony 2.0.0-5.4.49, 6.0.0-6.4.28, or 7.0.0-7.3.6, you are vulnerable.Check Version:
composer show symfony/http-foundation | grep versionsVerify Fix Applied:
After update, verify version is 5.4.50+, 6.4.29+, or 7.3.7+. Test authorization endpoints with crafted paths.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with unusual PATH_INFO values
- Access attempts to protected resources with non-standard paths
Network Indicators:
- HTTP requests where path doesn't start with forward slash but accesses protected resources
SIEM Query:
web_access_logs WHERE (url_path NOT LIKE '/%' AND response_code = 200 AND uri CONTAINS protected_resource)🔗 References
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2025-64500.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2025-64500.yaml
- https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac
- https://github.com/symfony/symfony/security/advisories/GHSA-3rg7-wf37-54rm
- https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass
