Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/symfony/symfony@2.6.0-alpha
purl pkg:composer/symfony/symfony@2.6.0-alpha
Tags Ghost
Next non-vulnerable version 5.4.51
Latest non-vulnerable version 8.0.5
Risk 3.1
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-d1kp-7aht-9qa2
Aliases:
CVE-2015-2308
GHSA-5c58-w9xc-qcj9
Esi Code Injection Applications with ESI support (and SSI support as of Symfony ) enabled and using the Symfony built-in reverse proxy (the `Symfony\Component\HttpKernel\HttpCache` class) are vulnerable to PHP code injection; a malicious user can inject PHP code that will be executed by the server.
2.6.6
Affected by 21 other vulnerabilities.
VCID-wwhm-mrr3-v7h3
Aliases:
CVE-2015-2309
GHSA-p684-f7fh-jv2j
Unsafe methods in the Request class The `Symfony\Component\HttpFoundation\Request` class provides a mechanism that ensures it does not trust HTTP header values coming from a "non-trusted" client. Unfortunately, it assumes that the remote address is always a trusted client if at least one trusted proxy is involved in the request; this allows a man-in-the-middle attack between the latest trusted proxy and the web server. The following methods are impacted: `getPort()`, `isSecure()`, `getHost()` and `getClientIps()`.
2.6.6
Affected by 21 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T12:46:57.601246+00:00 GitLab Importer Affected by VCID-d1kp-7aht-9qa2 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/symfony/symfony/CVE-2015-2308.yml 38.0.0
2026-04-01T12:46:56.852944+00:00 GitLab Importer Affected by VCID-wwhm-mrr3-v7h3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/symfony/symfony/CVE-2015-2309.yml 38.0.0