CyberRota Analysis
AI-GeneratedThe Symfony PHP framework is vulnerable to a path traversal issue in the UrlGenerator::doGenerate() method, which improperly handles dot-segment encoding, allowing attackers to manipulate route parameters and generate URLs that may lead to unauthorized access to different paths. This vulnerability affects versions prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, and poses a medium severity risk. Organizations using affected versions should prioritize updating to the patched releases to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters to generate URLs that collapse to a different path under RFC 3986 normalization. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
Related CVEs
Other vulnerabilities affecting the same vendor(s)