Symfony Patches PATH_INFO Parsing Flaw Leading to Authorization Bypass (CVE-2025-64500)

The Symfony project has released security updates for a newly disclosed vulnerability in its HTTP Foundation component, tracked as CVE-2025-64500 and rated CVSS 7.3, which stems from incorrect parsing of PATH_INFO and could lead to a limited authorization bypass in certain applications using the framework.

The flaw originates from how Symfony’s Request class interprets some URL paths, and according to the advisory, “The Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn’t start with a /.” This seemingly small deviation can undermine access controls that rely on a leading slash, potentially bypassing some rules built with the /-prefix assumption.

The issue affects multiple major Symfony branches, with 5.4.50, 6.4.29, and 7.3.7 cited as fixed versions, and patches released for the 5.4 branch alongside updates for all affected long-term support and stable versions. The project notes the fix enforces consistent URL normalization, ensuring that URL paths always start with a /. 15 November 2025. According to the advisory.