symfony — Vulnerabilities & Security Advisories 54

All 54 CVE vulnerabilities found in symfony, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for the product Symfony. It collects security advisories and vulnerability reports related to Symfony, covering a broad historical range of disclosed issues. Readers can use this aggregation to track the vendor’s published security notices, analyze specific weakness classes associated with the framework, and review the product’s overall vulnerability history.

Vendor: symfony

CVE ID	Title	CVSS	Severity	Published
CVE-2026-24739	Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operations CWE-88	6.3	Medium	2026-01-28
CVE-2025-64500	Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass CWE-647	7.3	High	2025-11-12
CVE-2024-51996	Symphony has an Authentication Bypass via RememberMe CWE-287	7.5	High	2024-11-13
CVE-2024-50340	Ability to change environment from query in symfony/runtime CWE-74	7.3	High	2024-11-06
CVE-2024-50341	Security::login does not take into account custom user_checker in symfony/security-bundle CWE-287	3.1	Low	2024-11-06
CVE-2024-50342	Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client CWE-200	3.1	Low	2024-11-06
CVE-2024-50343	Incorrect response from Validator when input ends with `\n` in symfony/validator CWE-20	3.1	Low	2024-11-06
CVE-2024-50345	Open redirect via browser-sanitized URLs in symfony/http-foundation CWE-601	3.1	Low	2024-11-06
CVE-2024-51736	Command execution hijack on Windows with Process class in symfony/process CWE-77	-	-	2024-11-06
CVE-2023-46735	Symfony potential Cross-site Scripting in WebhookController CWE-79	6.1	Medium	2023-11-10
CVE-2023-46734	Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters CWE-79	6.1	Medium	2023-11-10
CVE-2023-46733	Symfony possible session fixation vulnerability CWE-384	6.5	Medium	2023-11-10
CVE-2022-24894	Symfony storing cookie headers in HttpCache CWE-285	5.9	Medium	2023-02-03
CVE-2022-24895	Symfony vulnerable to Session Fixation of CSRF tokens CWE-384	6.3	Medium	2023-02-03
CVE-2022-23601	CSRF token missing in Symfony CWE-352	8.1	High	2022-02-01
CVE-2021-41270	CSV Injection in Symfony CWE-1236	6.5	Medium	2021-11-24
CVE-2021-41267	Webcache Poisoning in Symfony CWE-444	6.5	Medium	2021-11-24
CVE-2021-41268	Cookie persistence in Symfony CWE-384	6.5	Medium	2021-11-24
CVE-2021-32693	Authentication granted with multiple firewalls CWE-287	6.8	Medium	2021-06-17
CVE-2021-21424	Prevent user enumeration using Guard or the new Authenticator-based Security CWE-200	5.3	Medium	2021-05-13
CVE-2020-15094	RCE in Symfony CWE-212	8.0	High	2020-09-02
CVE-2020-5275	Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http CWE-285	7.6	High	2020-03-30
CVE-2020-5274	Exceptions displayed in non-debug configurations in Symfony CWE-209	4.6	Medium	2020-03-30
CVE-2020-5255	Prevent cache poisoning via a Response Content-Type header CWE-435	2.6	Low	2020-03-30

All 54 known CVE vulnerabilities affecting symfony with full Chinese analysis, references, and POCs where available.