Symfony ux-toolkit Path Traversal Arbitrary File Read/Write via Recipe Manifest (CVE-2025-55878)

Vulnerability Overview Vulnerability Name: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest Vulnerability Description: The command in the package installs files by copying files from a specified list of paths. Although the command attempts to protect against segments in the path, attackers can bypass this protection by constructing malicious paths, thereby enabling arbitrary file write and read operations. Since the copy operation creates missing parent directories and overwrites existing files—even when using the or options—attackers can overwrite files such as controllers, git hooks, or , leading to code execution. The operation on the source side is similarly affected, allowing out-of-directory local file reads. Scope of Impact Affected Versions: - (Composer) - - Fixed Versions: - - Remediation Fix Measures: - Introduced the helper function, which rejects any source or destination path containing segments, regardless of whether or is used as the separator. - This check is enforced within the (protecting both the source Finder and the File). - As a last line of defense, the installer re-validates fully resolved paths before each file system read and write operation. Additional Information CVSS v3 Base Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2025-55878 Credits: - Kocal: Remediation developer - Amoth: Finder Reporters: Pascal Cescon and Hugo Alliaume

Goal Reached Thanks to every supporter — we hit 100%!

Symfony ux-toolkit Path Traversal Arbitrary File Read/Write via Recipe Manifest (CVE-2025-55878)

More from this source