CVE-2025-64500
Sensiolabs Httpfoundation 2.0.0 – 5.4.50
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LSummary
CVE-2025-64500 is a high-severity Use of Non-Canonical URL Paths for Authorization Decisions (CWE-647) vulnerability in Sensiolabs Httpfoundation. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Symfony's HttpFoundation component, used within the Symfony PHP framework for web and console applications, is affected by CVE-2025-64500. In versions from 2.0.0 through 5.4.49, 6.4.28, and 7.3.6, the Request class mishandles certain PATH_INFO inputs, resulting in URL paths that do not begin with a leading slash. This behavior deviates from the expectations of access-control logic that assumes all paths are prefixed with /, and the issue is tracked under CWE-647.
An unauthenticated remote attacker can send crafted HTTP requests that trigger the flawed path representation. Successful exploitation allows limited bypass of authorization rules that depend on the slash prefix, potentially exposing resources with impacts to confidentiality, integrity, and availability as reflected in the CVSS 7.3 score.
Symfony security advisories and the corresponding patches direct users to upgrade to versions 5.4.50, 6.4.29, or 7.3.7 or later. These releases modify the Request class to enforce that all URL paths begin with a forward slash; the change is documented in the referenced GitHub commit and the official Symfony blog post. The EPSS score remains low with only minimal movement between its current and peak values.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-131928
Vulnerability Data
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7,…
more
the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V2.2.1V10.4.1
Mitigating Controls (NIST 800-53 r5) AI
Proper enforcement of authorization decisions requires canonical URL normalization before policy evaluation, directly stopping non-canonical bypasses.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing well-defined authorization policies prevents URL canonicalization bypasses when path handling is included in the implementation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover non-canonical URL bypasses but does not itself implement the preventive control.
Defining application security requirements that mandate canonical URL handling and authorization checks mitigates the weakness at design time.
Secure-coding standards that require URL canonicalization and safe path handling eliminate the root cause of the weakness.
Enforcing strict access-control rules on canonical resource identifiers directly prevents authorization bypass via non-canonical URLs.