CVE-2025-64500 PoC — Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

Source

https://github.com/B1ack4sh/Blackash-CVE-2025-64500

Associated Vulnerability

Title:Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass (CVE-2025-64500)
Description:Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.

Description

CVE-2025-64500

Readme

# ✨ CVE-2025-64500: Incorrect Parsing of PATH_INFO in Symfony 🚨

## 🌟 **Overview**  
🔍 **CVE-2025-64500** is a **moderate-severity** vulnerability in the **Symfony PHP framework** that allows **limited authorization bypass** due to flawed `PATH_INFO` parsing.  
📅 **Disclosed**: November 12, 2025 (via [Symfony Blog](https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass)) <sup>1</sup>

---

## 🛡️ **What’s the Issue?**  
⚠️ Symfony’s **HTTP Foundation** component mishandles `PATH_INFO` in URLs.  
🔓 Attackers can craft **malicious URLs** to **bypass route-level access controls**.  
🛑 **Not full admin takeover** — only **limited bypass** (e.g., accessing non-sensitive routes).

| Metric | Value |
|-------|-------|
| 🔗 **Attack Vector** | Network (Remote) |
| ⚡ **Complexity** | Low |
| 🔑 **Privileges Required** | None |
| 👤 **User Interaction** | None |
| 📊 **Impact** | Low (Confidentiality) |
| ⭐ **Estimated CVSS** | ~6.5 (Medium) |

---

## 🚩 **Affected Versions**  
| Component | Vulnerable | Fixed |
|---------|------------|-------|
| `symfony/http-foundation` | `< 7.1.2` | `≥ 7.1.2` |

> ⚠️ **Symfony 6.x (LTS)** users: Apply backported patch if available.

---

## 🛠️ **Fix It Fast!**  
```bash
composer update symfony/http-foundation
```

### 🔧 **Workarounds (If You Can’t Update)**  
1. 🛡️ Add **custom middleware** to sanitize `PATH_INFO`  
2. 🚧 Use **strict URL rules** in Nginx/Apache  
3. 📡 **Log & monitor** suspicious `PATH_INFO` patterns  

---

## 📚 **References**  
- 🔗 [Symfony Security Advisory](https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass) <sup>1</sup>  
- 🔍 [CVE Record (MITRE)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64500)  
- ⏳ NVD Entry: *Coming soon*  

---

> 💡 **Pro Tip**: This fits a growing trend of **routing & parsing bugs** in PHP frameworks (see Django’s CVE-2025-64459).  
> 🔍 **Patch now**, **log everything**, and **test your routes**!

Need help testing your Symfony app? Just ask! 🛠️✨

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!