CVE-2025-64500# ✨ CVE-2025-64500: Incorrect Parsing of PATH_INFO in Symfony 🚨
## 🌟 **Overview**
🔍 **CVE-2025-64500** is a **moderate-severity** vulnerability in the **Symfony PHP framework** that allows **limited authorization bypass** due to flawed `PATH_INFO` parsing.
📅 **Disclosed**: November 12, 2025 (via [Symfony Blog](https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass)) <sup>1</sup>
---
## 🛡️ **What’s the Issue?**
⚠️ Symfony’s **HTTP Foundation** component mishandles `PATH_INFO` in URLs.
🔓 Attackers can craft **malicious URLs** to **bypass route-level access controls**.
🛑 **Not full admin takeover** — only **limited bypass** (e.g., accessing non-sensitive routes).
| Metric | Value |
|-------|-------|
| 🔗 **Attack Vector** | Network (Remote) |
| ⚡ **Complexity** | Low |
| 🔑 **Privileges Required** | None |
| 👤 **User Interaction** | None |
| 📊 **Impact** | Low (Confidentiality) |
| ⭐ **Estimated CVSS** | ~6.5 (Medium) |
---
## 🚩 **Affected Versions**
| Component | Vulnerable | Fixed |
|---------|------------|-------|
| `symfony/http-foundation` | `< 7.1.2` | `≥ 7.1.2` |
> ⚠️ **Symfony 6.x (LTS)** users: Apply backported patch if available.
---
## 🛠️ **Fix It Fast!**
```bash
composer update symfony/http-foundation
```
### 🔧 **Workarounds (If You Can’t Update)**
1. 🛡️ Add **custom middleware** to sanitize `PATH_INFO`
2. 🚧 Use **strict URL rules** in Nginx/Apache
3. 📡 **Log & monitor** suspicious `PATH_INFO` patterns
---
## 📚 **References**
- 🔗 [Symfony Security Advisory](https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass) <sup>1</sup>
- 🔍 [CVE Record (MITRE)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64500)
- ⏳ NVD Entry: *Coming soon*
---
> 💡 **Pro Tip**: This fits a growing trend of **routing & parsing bugs** in PHP frameworks (see Django’s CVE-2025-64459).
> 🔍 **Patch now**, **log everything**, and **test your routes**!
Need help testing your Symfony app? Just ask! 🛠️✨
登录后查看神龙缓存的 POC 文件快照
登录查看