CVE-2025-64500

🗓️ 12 Nov 2025 21:40:57Reported by MendType

Improper PATH_INFO interpretation in Symfony HttpFoundation Request class allows access control bypass.

Reporter	Title	Published	Views	Family All 49
AstraLinux	Astra Linux – Vulnerability in symfony	13 Jan 202614:01	–	astralinux
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	2 Mar 202616:48	–	ibm
BDU FSTEC	Symphony HttpFoundation Data Compromise	13 Jan 202600:00	–	bdu_fstec
Chainguard	CVE-2025-64500 vulnerabilities	7 Jan 202601:30	–	cgr
Circl	CVE-2025-64500	12 Nov 202512:42	–	circl
CNNVD	Symfony 安全漏洞	12 Nov 202500:00	–	cnnvd
CVE	CVE-2025-64500	12 Nov 202521:40	–	cve
Cvelist	CVE-2025-64500 Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass	12 Nov 202521:40	–	cvelist
Debian CVE	CVE-2025-64500	12 Nov 202521:40	–	debiancve
EUVD	EUVD-2025-131928	12 Nov 202521:40	–	euvd

Vulners

Node

sensiolabs symfonyRange6.0.0–6.4.29

sensiolabs symfonyRange2.0.0–5.4.50

sensiolabs symfonyRange7.0.0–7.3.7

Source	Link
github	www.github.com/symfony/symfony/security/advisories/GHSA-3rg7-wf37-54rm
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2025-64500.yaml
symfony	www.symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2025-64500.yaml
github	www.github.com/symfony/symfony
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64500.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-64500
github	www.github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac

08 Oct 2026 00:05Current

7.1High risk

Vulners AI Score7.1

CVSS 46.9

CVSS 3.17.3

EPSS0.01408

SSVC