CVE-2025-64500 PoC — Symfony 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64500.yaml

Associated Vulnerability

Title:Symfony 安全漏洞 (CVE-2025-64500)
Description:Symfony是Symfony公司的一个用于 Web 和控制台应用程序的 PHP 框架以及一组可重用的 PHP 组件。 Symfony 5.4.50之前版本、6.4.29之前版本和7.3.7之前版本存在安全漏洞，该漏洞源于PATH_INFO解析不当，可能导致绕过访问控制规则。

Description

Symfony HttpFoundation component >= 2.0.0 and prior to versions 5.4.50, 6.4.29, and 7.3.7 contains an access control bypass vulnerability. The Request class improperly interprets some PATH_INFO values, producing URL paths without a leading `/`. This allows bypassing access control rules that are built with the `/-prefix` assumption.

File Snapshot


 id: CVE-2025-64500

info:
  name: Symfony HttpFoundation - Access Control Bypass via PATH_INFO
  aut

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!