N/A

An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint `string` in a setter method (e.g. `setName(string $name)`) of a class that's the `data_class` of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then `UploadedFile::__toString()` is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution.

N/A

N/A

Sensio Labs Symfony 安全漏洞

Sensio Labs Symfony是法国Sensio Labs公司的一套免费的、基于MVC架构的PHP开发框架。该框架提供常用的功能组件及工具，可用于快速创建复杂的WEB程序。 Sensio Labs Symfony中存在安全漏洞。攻击者可利用该漏洞泄露上传文件的路径。以下版本受到影响：Sensio Labs Symfony 2.7.0版本至2.7.49版本，2.8.0版本至2.8.48版本，3.0.0版本至3.4.19版本，4.0.0版本至4.0.14版本，4.1.0版本至4.1.8版本，4.2.0

N/A

N/A