VulnerableCode Package Details - pkg:composer/symfony/symfony@5.4.23

Vulnerabilities affecting this package (25)

Advisory	Summary	Fixed in package version
GHSA-3rg7-wf37-54rm Aliases: CVE-2025-64500	Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass ### Description The `Request` class improperly interprets some `PATH_INFO` …	5.4.50 Vulnerable
GHSA-x8vp-gf4q-mw5j Aliases: CVE-2024-50340	Symfony allows changing the environment through a query ### Description When the `register_argc_argv` php directive is set to `on` , …	5.4.46 Vulnerable
GHSA-g3rh-rrhp-jhh9 Aliases: CVE-2024-50343	Symfony has an incorrect response from Validator when input ends with `\n` ### Description It is possible to trick a …	5.4.43 Vulnerable
GHSA-qq5c-677p-737q Aliases: CVE-2024-51736	Symfony vulnerable to command execution hijack on Windows with Process class ### Description On Windows, when an executable file named …	5.4.46 Vulnerable
GHSA-9c3x-r3wp-mgxm Aliases: CVE-2024-50342	Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient ### Description When using the `NoPrivateNetworkHttpClient`, some internal information is still …	5.4.47 Vulnerable
GHSA-m2wj-r6g3-fxfx Aliases: CVE-2023-46733	Symfony possible session fixation vulnerability ### Description SessionStrategyListener does not always migrate the session after a successful login. It only …	5.4.31 Vulnerable
GHSA-q847-2q57-wmr3 Aliases: CVE-2023-46734	Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters ### Description Some Twig filters in CodeExtension use "is_safe=html" but don't actually …	5.4.31 Vulnerable
GHSA-38cx-cq6f-5755 Aliases: CVE-2026-48736	Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient ### Description `Symfony\Component\HttpClient\NoPrivateNetworkHttpClient` is documented as …	5.4.53 Vulnerable
GHSA-6h46-9jf5-q59x Aliases: CVE-2026-48489	Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes ### Description When a firewall is configured …	5.4.53 Vulnerable
GHSA-h5x3-xfc9-m39h Aliases: CVE-2026-48784	Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization …	5.4.53 Vulnerable
GHSA-x6g4-fwcc-jj8w Aliases: CVE-2026-45071	Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true ### Description `symfony/dom-crawler` provides the `Crawler` class for …	5.4.52 Vulnerable
GHSA-vqc8-7275-q272 Aliases: CVE-2026-45070	Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names ### Description `Symfony\Component\Mime\Header\ParameterizedHeader` (and the related parameter handling …	5.4.52 Vulnerable
GHSA-c2p3-7m5p-cv8x Aliases: CVE-2026-45133	Symfony hardened the parser when handling untrusted input ### Description `Symfony\Component\Yaml\Parser` is the entry point for parsing YAML strings into …	5.4.52 Vulnerable
GHSA-4qpc-3hr4-r2p4 Aliases: CVE-2026-45304	Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") ### Description `Symfony\Component\Yaml\Parser` resolves YAML aliases …	5.4.52 Vulnerable
GHSA-72xp-p242-47p9 Aliases: CVE-2026-45065	Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection ### Description Symfony routes can …	5.4.52 Vulnerable
GHSA-qpmx-3rfj-7rhv Aliases: CVE-2026-45067	Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address ### Description `Symfony\Component\Mime\Address` is the value-object every Symfony …	5.4.52 Vulnerable
GHSA-xx3c-qf5g-hc39 Aliases: CVE-2026-45068	Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address ### Description Symfony Mailer selects a transport via the …	5.4.52 Vulnerable
GHSA-m7v2-7gxm-vc2v Aliases: CVE-2026-45077	Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener ### Description `Symfony\Bridge\Monolog\Command\ServerLogCommand` (the `server:log` console command) is a development-time …	5.4.52 Vulnerable
GHSA-6qh9-h6wf-jgqc Aliases: CVE-2026-45073	Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix ### Description `Symfony\Component\Cache\Adapter\PdoAdapter` is the PDO-backed cache adapter. Its `clear($prefix)` …	5.4.52 Vulnerable
GHSA-9frc-8383-795m Aliases: CVE-2026-45305	Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex ### Description `Symfony\Component\Yaml\Parser::cleanup()` strips the optional `%YAML` directive …	5.4.52 Vulnerable
GHSA-ph86-p8f6-f9r2 Aliases: CVE-2026-45063	Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator ### Description `X509Authenticator` implements client-certificate (mTLS) authentication: the web …	5.4.52 Vulnerable
GHSA-r39x-jcww-82v6 Aliases: CVE-2026-24739	Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows ### Summary The Symfony Process …	5.4.51 Vulnerable
CVE-2024-50345 Aliases: GHSA-mrqx-rp3w-jpjp	Symfony vulnerable to open redirect via browser-sanitized URLs The `Request` class, does not parse URI with special characters the same …	5.4.46 Vulnerable 6.4.14 Vulnerable 7.1.7 Vulnerable 5.4.46 Vulnerable 6.4.14 Vulnerable 7.1.7 Vulnerable
GHSA-2v3c-qxhr-7vpv Aliases: CVE-2026-109413	Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process ### Description `Yaml\Parser::lexInlineStructure()` recursed through …	5.4.54 Not vulnerable
GHSA-r925-mgvr-h9cc Aliases: CVE-2026-108082	Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header ### Description `HeaderUtils::split()` parsed header values with a pattern whose …	5.4.54 Not vulnerable

Next non-vulnerable version	5.4.54
Latest non-vulnerable version	8.1.7
Risk score	3.9