Arbitrary Argument Injection in Symfony HTTP Foundation and Mime

CVE-2019-18888

What is CVE-2019-18888?

A vulnerability exists in Symfony versions ranging from 2.8.0 to 2.8.50, 3.4.0 to 3.4.34, and 4.2.0 to 4.2.11 due to improper validation of user input used for MIME type checks. If unvalidated input is supplied as the file argument for MIME type validation, it can allow an attacker to inject arbitrary arguments into the underlying file command, potentially leading to unauthorized code execution or other security breaches.

References