https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T11:26:10.876894+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-00312 bdu:2026-00312 2026-10-05T11:26:10.881989+00:00 bdu:2026-00312 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0999 certfr-2025-avi-0999 — Une vulnérabilité a été découverte dans les produits Symfony. Elle permet à un attaquant de provoquer un contournement… 2026-10-05T11:26:10.882030+00:00 certfr-2025-avi-0999 https://cve.radiocsirt.org/vuln/euvd-2026-260741 EUVD-2026-260741 2026-10-05T11:26:10.882051+00:00 EUVD-2026-260741 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64500 fkie_cve-2025-64500 2026-10-05T11:26:10.882063+00:00

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.

 https://cve.radiocsirt.org/vuln/ghsa-3rg7-wf37-54rm GHSA-3rg7-wf37-54rm — Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass 2026-10-05T11:26:10.882098+00:00

Affected: Packagist: symfony/http-foundation, Packagist: symfony/symfony

### Description

The `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption.

### Resolution

The `Request` class now ensures that URL paths always start with a `/`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac) for branch 5.4.

### Credits

We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-64500 UBUNTU-CVE-2025-64500 2026-10-05T11:26:10.882135+00:00

Affected: Ubuntu:16.04:LTS: symfony, Ubuntu:Pro:18.04:LTS: symfony, Ubuntu:Pro:20.04:LTS: symfony, Ubuntu:Pro:22.04:LTS: symfony, Ubuntu:Pro:24.04:LTS: symfony, Ubuntu:25.10: symfony, Ubuntu:26.04:LTS: symfony

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.