https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 11:25:54 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-00312 bdu:2026-00312 https://cve.radiocsirt.org/vuln/bdu:2026-00312 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0999 certfr-2025-avi-0999 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0999 https://cve.radiocsirt.org/vuln/euvd-2026-260741 EUVD-2026-260741 https://cve.radiocsirt.org/vuln/euvd-2026-260741 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64500 <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony&#39;s HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn&#39;t start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony&#39;s HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn&#39;t start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-64500 https://cve.radiocsirt.org/vuln/ghsa-3rg7-wf37-54rm <p><strong>Affected:</strong> Packagist: symfony/http-foundation, Packagist: symfony/symfony</p> <p>### Description</p> <p>The `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn&#39;t start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption.</p> <p>### Resolution</p> <p>The `Request` class now ensures that URL paths always start with a `/`.</p> <p>The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac) for branch 5.4.</p> <p>### Credits</p> <p>We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.</p> <p><strong>Affected:</strong> Packagist: symfony/http-foundation, Packagist: symfony/symfony</p> <p>### Description</p> <p>The `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn&#39;t start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption.</p> <p>### Resolution</p> <p>The `Request` class now ensures that URL paths always start with a `/`.</p> <p>The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac) for branch 5.4.</p> <p>### Credits</p> <p>We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.</p> https://cve.radiocsirt.org/vuln/ghsa-3rg7-wf37-54rm https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-64500 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: symfony, Ubuntu:Pro:18.04:LTS: symfony, Ubuntu:Pro:20.04:LTS: symfony, Ubuntu:Pro:22.04:LTS: symfony, Ubuntu:Pro:24.04:LTS: symfony, Ubuntu:25.10: symfony, Ubuntu:26.04:LTS: symfony</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony&#39;s HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn&#39;t start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: symfony, Ubuntu:Pro:18.04:LTS: symfony, Ubuntu:Pro:20.04:LTS: symfony, Ubuntu:Pro:22.04:LTS: symfony, Ubuntu:Pro:24.04:LTS: symfony, Ubuntu:25.10: symfony, Ubuntu:26.04:LTS: symfony</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony&#39;s HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn&#39;t start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-64500