Most recent entries from all

certa-2013-avi-002 — Deux vulnérabilités ont été corrigées dans Symfony. La première concerne un accès aux route…

2026-10-26T03:05:39.382737+00:00

certa-2013-avi-002

EUVD-2026-178662

2026-10-26T03:05:39.382787+00:00

EUVD-2026-178662

fkie_cve-2012-6431

2026-10-26T03:05:39.382812+00:00

Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.

GHSA-83c3-qx27-2rwr — Symfony Allows URI Restrictions Bypass Via Double-Encoded String

2026-10-26T03:05:39.382860+00:00

Affected: Packagist: symfony/http-foundation, Packagist: symfony/routing, Packagist: symfony/security, Packagist: symfony/symfony

On the Symfony 2.0.x version, there's a security issue that allows access to routes protected by a firewall even when the user is not logged in.

Both the Routing component and the Security component uses the path returned by `getPathInfo()` to match a Request. The `getPathInfo()` returns a decoded path, but the Routing component (`Symfony\Component\Routing\Matcher\UrlMatcher`) decodes the path a second time; whereas the Security component, `Symfony\Component\HttpFoundation\RequestMatcher`, does not.

This difference causes Symfony 2.0 to be vulnerable to double encoding attacks.

gsd-2012-6431

2026-10-26T03:05:39.382926+00:00

gsd-2012-6431