VulnerableCode Package Details - pkg:composer/symfony/symfony@3.4.2

Vulnerabilities affecting this package (54)

Advisory	Summary	Fixed in package version
GHSA-5pv8-ppvj-4h68 Aliases: CVE-2021-21424	Prevent user enumeration using Guard or the new Authenticator-based Security Description ----------- The ability to enumerate users was possible without …	3.4.49 Vulnerable
GHSA-3rg7-wf37-54rm Aliases: CVE-2025-64500	Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass ### Description The `Request` class improperly interprets some `PATH_INFO` …	5.4.50 Vulnerable
GHSA-8wgj-6wx8-h5hq Aliases: CVE-2018-14773	Symfony HTTP Foundation web cache poisoning An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through …	3.4.14 Vulnerable
GHSA-q8hg-pf8v-cxrv Aliases: CVE-2019-18887	Symfony Http-Kernel has non-constant time comparison in UriSigner When checking the signature of an URI (an ESI fragment URL for …	3.4.35 Vulnerable
GHSA-g996-q5r8-w7g2 Aliases: CVE-2019-10909	Symfony Cross-site Scripting (XSS) vulnerability In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x …	3.4.26 Vulnerable
GHSA-79gr-58r3-pwm3 Aliases: CVE-2019-18889	Symfony Unsafe Cache Serialization Could Enable RCE An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and …	3.4.35 Vulnerable
GHSA-xhh6-956q-4q69 Aliases: CVE-2019-18888	Argument injection in a MimeTypeGuesser in Symfony An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 …	3.4.35 Vulnerable
GHSA-g3rh-rrhp-jhh9 Aliases: CVE-2024-50343	Symfony has an incorrect response from Validator when input ends with `\n` ### Description It is possible to trick a …	5.4.43 Vulnerable
GHSA-qq5c-677p-737q Aliases: CVE-2024-51736	Symfony vulnerable to command execution hijack on Windows with Process class ### Description On Windows, when an executable file named …	5.4.46 Vulnerable
GHSA-q847-2q57-wmr3 Aliases: CVE-2023-46734	Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters ### Description Some Twig filters in CodeExtension use "is_safe=html" but don't actually …	4.4.51 Vulnerable
GHSA-3gv2-29qc-v67m Aliases: CVE-2022-24895	Symfony vulnerable to Session Fixation of CSRF tokens Description ----------- When authenticating users Symfony by default regenerates the session ID …	4.4.50 Vulnerable
GHSA-h7vf-5wrv-9fhv Aliases: CVE-2022-24894	Symfony storing cookie headers in HttpCache Description ----------- The Symfony HTTP cache system acts as a reverse proxy: it caches …	4.4.50 Vulnerable
GHSA-6h46-9jf5-q59x Aliases: CVE-2026-48489	Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes ### Description When a firewall is configured …	5.4.53 Vulnerable
GHSA-h5x3-xfc9-m39h Aliases: CVE-2026-48784	Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization …	5.4.53 Vulnerable
GHSA-x6g4-fwcc-jj8w Aliases: CVE-2026-45071	Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true ### Description `symfony/dom-crawler` provides the `Crawler` class for …	5.4.52 Vulnerable
GHSA-vqc8-7275-q272 Aliases: CVE-2026-45070	Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names ### Description `Symfony\Component\Mime\Header\ParameterizedHeader` (and the related parameter handling …	5.4.52 Vulnerable
GHSA-c2p3-7m5p-cv8x Aliases: CVE-2026-45133	Symfony hardened the parser when handling untrusted input ### Description `Symfony\Component\Yaml\Parser` is the entry point for parsing YAML strings into …	5.4.52 Vulnerable
GHSA-4qpc-3hr4-r2p4 Aliases: CVE-2026-45304	Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") ### Description `Symfony\Component\Yaml\Parser` resolves YAML aliases …	5.4.52 Vulnerable
GHSA-72xp-p242-47p9 Aliases: CVE-2026-45065	Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection ### Description Symfony routes can …	5.4.52 Vulnerable
GHSA-qpmx-3rfj-7rhv Aliases: CVE-2026-45067	Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address ### Description `Symfony\Component\Mime\Address` is the value-object every Symfony …	5.4.52 Vulnerable
GHSA-xx3c-qf5g-hc39 Aliases: CVE-2026-45068	Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address ### Description Symfony Mailer selects a transport via the …	5.4.52 Vulnerable
GHSA-m7v2-7gxm-vc2v Aliases: CVE-2026-45077	Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener ### Description `Symfony\Bridge\Monolog\Command\ServerLogCommand` (the `server:log` console command) is a development-time …	5.4.52 Vulnerable
GHSA-6qh9-h6wf-jgqc Aliases: CVE-2026-45073	Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix ### Description `Symfony\Component\Cache\Adapter\PdoAdapter` is the PDO-backed cache adapter. Its `clear($prefix)` …	5.4.52 Vulnerable
GHSA-9frc-8383-795m Aliases: CVE-2026-45305	Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex ### Description `Symfony\Component\Yaml\Parser::cleanup()` strips the optional `%YAML` directive …	5.4.52 Vulnerable
GHSA-ph86-p8f6-f9r2 Aliases: CVE-2026-45063	Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator ### Description `X509Authenticator` implements client-certificate (mTLS) authentication: the web …	5.4.52 Vulnerable
GHSA-r39x-jcww-82v6 Aliases: CVE-2026-24739	Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows ### Summary The Symfony Process …	5.4.51 Vulnerable
CVE-2018-11386	Insufficient Session Expiration An issue was discovered in the `HttpFoundation` component in Symfony. The `PDOSessionHandler` class allows storing sessions on …	2.8.41 Vulnerable 3.4.11 Vulnerable 4.0.11 Vulnerable
CVE-2018-11407	Improper Authentication An issue was discovered in the Ldap component in Symfony. It allows remote attackers to bypass authentication by …	2.8.37 Vulnerable 3.4.7 Vulnerable 4.0.7 Vulnerable
CVE-2018-14773	Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') An issue was discovered in Http Foundation in Symfony. It arises from …	4.1.3 Vulnerable 2.8.44 Vulnerable 3.4.14 Vulnerable 4.0.14 Vulnerable
CVE-2021-21424 Aliases: GHSA-5pv8-ppvj-4h68	Information Exposure Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The …	5.2.8 Vulnerable 4.4.23 Vulnerable 3.4.48 Vulnerable
CVE-2019-10909	Cross-site Scripting In Symfony, validation messages are not escaped, which can lead to XSS when user input is included. This …	4.2.7 Vulnerable 2.8.50 Vulnerable 3.4.26 Vulnerable 2.7.51 Vulnerable
CVE-2018-11408	URL Redirection to Untrusted Site (Open Redirect) The security handlers in the Security component in Symfony have an Open redirect …	2.7.48 Vulnerable 2.8.41 Vulnerable 3.4.11 Vulnerable 4.0.11 Vulnerable
CVE-2018-19789	Unrestricted Upload of File with Dangerous Type When using the scalar type hint `string` in a setter method (e.g. `setName(string$name)`) …	4.1.9 Vulnerable 4.2.1 Vulnerable 2.7.50 Vulnerable 2.8.49 Vulnerable 3.4.20 Vulnerable 4.0.15 Vulnerable
CVE-2018-19790	URL Redirection to Untrusted Site (Open Redirect) By using backslashes in the `_failure_path` input field of login forms, an attacker …	4.1.9 Vulnerable 4.2.1 Vulnerable 2.7.50 Vulnerable 2.8.49 Vulnerable 3.4.20 Vulnerable 4.0.15 Vulnerable
CVE-2018-11406	Cross-Site Request Forgery (CSRF) By default, a user's session is invalidated when the user is logged out. This behavior can …	2.8.41 Vulnerable 3.4.11 Vulnerable 4.0.11 Vulnerable
CVE-2018-11385	Session Fixation A session fixation vulnerability within the `Guard` login feature may allow an attacker to impersonate a victim towards …	2.8.41 Vulnerable 3.4.11 Vulnerable 4.0.11 Vulnerable
CVE-2019-10912	Deserialization of Untrusted Data In Symfony it is possible to cache objects that may contain bad user input. On serialization …	4.2.7 Vulnerable 2.8.50 Vulnerable 3.4.26 Vulnerable
CVE-2019-10913	SQL Injection In Symfony, HTTP Methods provided as verbs or using the override header may be treated as trusted input, …	4.2.7 Vulnerable 2.8.50 Vulnerable 3.4.26 Vulnerable 2.7.51 Vulnerable
CVE-2019-10911	Improper Authentication In Symfony, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user …	4.2.7 Vulnerable 2.8.50 Vulnerable 3.4.26 Vulnerable 2.7.51 Vulnerable
GHSA-g4rg-rw65-8hfg Aliases: CVE-2018-11385	Symfony Session Fixation Vulnerability An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, …	3.4.11 Vulnerable 3.4.11 Vulnerable
GHSA-35c5-28pg-2qg4 Aliases: CVE-2018-11407	Symfony Authentication Bypass An issue was discovered in the LDAP component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x …	3.4.7 Vulnerable 3.4.7 Vulnerable
GHSA-x3cf-w64x-4cp2 Aliases: CVE-2018-19789	Symfony Path Disclosure An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before …	3.4.20 Vulnerable 3.4.20 Vulnerable
GHSA-g4g7-q726-v5hg Aliases: CVE-2018-11406	Symfony CSRF Token Fixation An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, …	3.4.11 Vulnerable 3.4.11 Vulnerable
GHSA-89r2-5g34-2g47 Aliases: CVE-2018-19790	Symfony Open Redirect An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x …	3.4.20 Vulnerable 3.4.20 Vulnerable
GHSA-7hwc-2cq4-6x2w Aliases: CVE-2018-11408	Symfony Open Redirect The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x …	3.4.11 Vulnerable 3.4.11 Vulnerable
GHSA-r2rq-3h56-fqm4 Aliases: CVE-2018-11386	Symfony DoS An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before …	3.4.11 Vulnerable 3.4.11 Vulnerable
GHSA-pgwj-prpq-jpc2 Aliases: CVE-2019-10910	Symfony Service IDs Allow Injection In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x …	3.4.26 Vulnerable 3.4.26 Vulnerable
GHSA-x92h-wmg2-6hp7 Aliases: CVE-2019-10913	Invalid HTTP method overrides allow possible XSS or other attacks in Symfony In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x …	3.4.26 Vulnerable 3.4.26 Vulnerable
GHSA-w2fr-65vp-mxw3 Aliases: CVE-2019-10912	Deserialization of untrusted data in Symfony In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, …	3.4.26 Vulnerable 3.4.26 Vulnerable
GHSA-cchx-mfrc-fwqr Aliases: CVE-2019-10911	Improper authentication in Symfony In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before …	3.4.26 Vulnerable 3.4.26 Vulnerable
CVE-2024-50345 Aliases: GHSA-mrqx-rp3w-jpjp	Symfony vulnerable to open redirect via browser-sanitized URLs The `Request` class, does not parse URI with special characters the same …	5.4.46 Vulnerable 6.4.14 Vulnerable 7.1.7 Vulnerable 5.4.46 Vulnerable 6.4.14 Vulnerable 7.1.7 Vulnerable
CVE-2022-23601 Aliases: GHSA-vvmr-8829-6whx	Cross-Site Request Forgery (CSRF) Symfony is a PHP framework for web and console applications and a set of reusable PHP …	5.4.4 Vulnerable 5.3.15 Vulnerable 6.0.4 Vulnerable 5.4.4 Vulnerable 5.3.15 Vulnerable 6.0.4 Vulnerable
GHSA-66p6-7p29-55p9 Aliases: CVE-2018-14774	Symfony Host Header Injection An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through …	3.4.14 Vulnerable 4.0.14 Vulnerable 4.1.3 Vulnerable 3.4.14 Vulnerable 4.0.14 Vulnerable 4.1.3 Vulnerable 3.4.14 Vulnerable
GHSA-2v3c-qxhr-7vpv Aliases: CVE-2026-109413	Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process ### Description `Yaml\Parser::lexInlineStructure()` recursed through …	5.4.54 Not vulnerable

Next non-vulnerable version	5.4.54
Latest non-vulnerable version	8.1.7
Risk score	4.4