Improper URL Path Interpretation Vulnerability in Symfony PHP Framework
CVE-2025-64500

7.3HIGH

Key Information:

Vendor: Symfony
Status: Symfony
Vendor: CVE Published:; 12 November 2025

What is CVE-2025-64500?

CVE-2025-64500 is a vulnerability identified within the Symfony PHP Framework, a widely used open-source framework for building web and console applications. This specific vulnerability relates to the Request class within Symfony's HttpFoundation component, which is responsible for managing HTTP requests. The flaw is a result of improper interpretation of URL path information (PATH_INFO), leading to situations where URLs may be represented without a leading slash (/). This can enable attackers to bypass access control mechanisms that are based on the assumption that URL paths will always start with a /. Such a weakness can significantly compromise the integrity of an organization's web applications, potentially allowing unauthorized access to restricted areas of the system.

Potential impact of CVE-2025-64500

Access Control Bypass: The core impact of this vulnerability is the potential for unauthorized users to access restricted parts of a web application. Since access control rules may not effectively check for the absence of a leading slash, attackers can exploit this to gain entry into sensitive areas of an application, leading to potential data exposure or modification.
Data Breaches: By bypassing access control, attackers could access, alter, or exfiltrate sensitive data stored within the affected applications. This could have serious repercussions, especially for organizations that process sensitive information such as personal data, financial records, or proprietary information.
Compromised Application Integrity: The vulnerability may lead to a broader compromise of the application's integrity, as attackers could manipulate request handling to perform actions that the application should not allow. This can result in the installation of malicious components, further exploitation of the environment, or even the deployment of malware within the organizational infrastructure.