Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

🗓️ 12 Nov 2025 21:50:37Reported by GitHub Advisory DatabaseType

Symfony fixes PATH_INFO parsing to ensure path begins with a slash and prevents bypass.

Reporter	Title	Published	Views	Family All 49
AstraLinux	Astra Linux – Vulnerability in symfony	13 Jan 202614:01	–	astralinux
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	2 Mar 202616:48	–	ibm
BDU FSTEC	Symphony HttpFoundation Data Compromise	13 Jan 202600:00	–	bdu_fstec
Chainguard	CVE-2025-64500 vulnerabilities	7 Jan 202601:30	–	cgr
Circl	CVE-2025-64500	12 Nov 202512:42	–	circl
CNNVD	Symfony security vulnerabilities	12 Nov 202500:00	–	cnnvd
CVE	CVE-2025-64500	12 Nov 202521:40	–	cve
Cvelist	CVE-2025-64500 Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass	12 Nov 202521:40	–	cvelist
Debian CVE	CVE-2025-64500	12 Nov 202521:40	–	debiancve
EUVD	EUVD-2025-131928	12 Nov 202521:40	–	euvd

Vulners

Node

symfony symfonyRange7.0.0–7.3.7composer

symfony symfonyRange6.0.0–6.4.29composer

symfony symfonyRange2.0.0–5.4.50composer

symfony http-foundationRange7.0.0–7.3.7composer

symfony http-foundationRange6.0.0–6.4.29composer

Source	Link
github	www.github.com/symfony/symfony/security/advisories/GHSA-3rg7-wf37-54rm
github	www.github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2025-64500.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2025-64500.yaml
symfony	www.symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-64500
github	www.github.com/advisories/GHSA-3rg7-wf37-54rm

15 Nov 2025 03:13Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.3

EPSS0.01408

SSVC