CVE-2025-64500 Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
Attackers can bypass access control rules in Symfony applications by exploiting improper PATH_INFO parsing that violates path prefix assumptions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64500?
CVE-2025-64500 is a high-severity authentication bypass vulnerability in Sensiolabs Symfony, published on 12 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.
Weakness: CWE-647
Which versions are affected by CVE-2025-64500?
12 open source packages ship an affected version, including symfony/http-foundation and symfony/symfony. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
symfony/http-foundation Packagist | All versions | 5.4.50 |
symfony/http-foundation Packagist | All versions | 5.4.50 |
symfony/http-foundation Packagist | From 6.0.0 | 6.4.29 |
symfony/http-foundation Packagist | From 6.0.0 | 6.4.29 |
symfony/http-foundation Packagist | From 7.0.0 | 7.3.7 |
symfony/http-foundation Packagist | From 7.0.0 | 7.3.7 |
6 more packages
symfony/symfony Packagist | From 2.0.0 | 5.4.50 |
symfony/symfony Packagist | From 2.0.0 | 5.4.50 |
symfony/symfony Packagist | From 6.0.0 | 6.4.29 |
symfony/symfony Packagist | From 6.0.0 | 6.4.29 |
symfony/symfony Packagist | From 7.0.0 | 7.3.7 |
symfony/symfony Packagist | From 7.0.0 | 7.3.7 |
Products include Sensiolabs Httpfoundation, Sensiolabs Symfony.
How do I fix CVE-2025-64500?
Upgrade symfony/http-foundation to a fixed version for your release line: 5.4.50, 6.4.29 or 7.3.7.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-64500 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64500 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as CLSA-2025-1766451449, CLSA-2026-1768265576, DEBIAN-CVE-2025-64500, GHSA-3rg7-wf37-54rm, UBUNTU-CVE-2025-64500.