CVE-2025-645007.3HighCWE-647

CVE-2025-64500: Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

symfony

Affected: symfony · Exploitation: check available, not yet exploited

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.4%probability of exploitation in the next 30 days

73rd percentile

050100

Higher than 73% of scored CVEs

7.3HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

symfony · symfony>= 2.0.0, < 5.4.50; >= 6.0.0, < 6.4.29; >= 7.0.0, < 7.3.7

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
CISA KEV: Not listed
Public check: Symfony HttpFoundation - Access Control Bypass via PATH_INFO · nuclei template in projectdiscovery/nuclei-templates
Weakness: Use of Non-Canonical URL Paths for Authorization Decisions · Access Control
Vendor: symfony
Published: November 2025
Band: Check available, not yet exploited, November 2025

CoverageNo articles yet

No CyberSIXT article names CVE-2025-64500 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.