Improper Input Validation

🗓️ 13 Dec 2025 05:51:02Reported by Veracode Vulnerability DatabaseType

Symfony permits access control bypass via PATH_INFO in Request for URLs not starting with a slash.

Reporter	Title	Published	Views	Family All 37
AstraLinux	Astra Linux - уязвимость в symfony	3 May 202623:59	–	astralinux
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	2 Mar 202616:48	–	ibm
Chainguard	CVE-2025-64500 vulnerabilities	7 Jan 202601:30	–	cgr
Circl	CVE-2025-64500	12 Nov 202512:42	–	circl
CNNVD	Symfony 安全漏洞	12 Nov 202500:00	–	cnnvd
CVE	CVE-2025-64500	12 Nov 202521:40	–	cve
Cvelist	CVE-2025-64500 Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass	12 Nov 202521:40	–	cvelist
Debian CVE	CVE-2025-64500	12 Nov 202521:40	–	debiancve
EUVD	EUVD-2025-131928	12 Nov 202521:40	–	euvd
Fedora	[SECURITY] Fedora 42 Update: nextcloud-32.0.2-1.fc42	3 Dec 202501:12	–	fedora

Vulners

Node

symfony symfony/symfonyRangev2.0.0BETA1–2.0.0BETA1php

symfony symfony/symfonyRangev6.0.0-BETA1–6.0.0-BETA1php

symfony symfony/symfonyRangev7.0.0-BETA1–7.0.0-BETA1php

Source	Link
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2025-64500.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2025-64500.yaml
symfony	www.symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass
github	www.github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac
github	www.github.com/symfony/symfony/security/advisories/GHSA-3rg7-wf37-54rm
github	www.github.com/symfony/symfony

10 Apr 2026 11:07Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.3

EPSS0.06307

SSVC