An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8.
Priority MEDIUM 48CWE-116Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
Why it matters now
EPSS 0.03354 88th percentileScored 2026-11-07
Fix Fixed symfony/symfony (Packagist): 4.2.12, 4.3.8symfony/var-exporter (Packagist): 4.2.12, 4.3.8
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | symfony/symfony (Packagist) | 4.2.0 to before 4.2.12 | 4.2.12 | Patch available | GHSA-w4rc-rx25-8m86 |
| — | symfony/symfony (Packagist) | 4.3.0 to before 4.3.8 | 4.3.8 | Patch available | GHSA-w4rc-rx25-8m86 |
| — | symfony/var-exporter (Packagist) | 4.2.0 to before 4.2.12 | 4.2.12 | Patch available | GHSA-w4rc-rx25-8m86 |
| — | symfony/var-exporter (Packagist) | 4.3.0 to before 4.3.8 | 4.3.8 | Patch available | GHSA-w4rc-rx25-8m86 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- symfony/symfony (Packagist) Vendor— Affected 4.2.0 to before 4.2.12 Fixed in 4.2.12 Patch available GHSA-w4rc-rx25-8m86
- symfony/symfony (Packagist) Vendor— Affected 4.3.0 to before 4.3.8 Fixed in 4.3.8 Patch available GHSA-w4rc-rx25-8m86
- symfony/var-exporter (Packagist) Vendor— Affected 4.2.0 to before 4.2.12 Fixed in 4.2.12 Patch available GHSA-w4rc-rx25-8m86
- symfony/var-exporter (Packagist) Vendor— Affected 4.3.0 to before 4.3.8 Fixed in 4.3.8 Patch available GHSA-w4rc-rx25-8m86
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* | 4.2.0 to before 4.2.12; 4.3.0 to before 4.3.8 | Vulnerable | sensiolabs |
- cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* Versions 4.2.0 to before 4.2.12; 4.3.0 to before 4.3.8 Vulnerable ·sensiolabs
Remediation
- Fix · GHSA-w4rc-rx25-8m86 symfony/symfony (Packagist) Fixed in 4.2.12 Advisory →
- Fix · GHSA-w4rc-rx25-8m86 symfony/symfony (Packagist) Fixed in 4.3.8 Advisory →
- Fix · GHSA-w4rc-rx25-8m86 symfony/var-exporter (Packagist) Fixed in 4.2.12 Advisory →
- Fix · GHSA-w4rc-rx25-8m86 symfony/var-exporter (Packagist) Fixed in 4.3.8 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-11325
- 2026-10-03 Alias added: GHSA-w4rc-rx25-8m86
References
Advisory 4
More sensiolabs Symfony vulnerabilities
- TI-2019-13616 An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0… CVSS 3.1CRITICAL 9.8
- TI-2018-10604 An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through… CVSS 3.1MEDIUM 6.5
- TI-2019-08131 In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and… CVSS 3.1CRITICAL 9.8
- TI-2016-02159 Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass… CVSS 3.0CRITICAL 9.8
- TI-2018-08136 An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x… CVSS 3.0CRITICAL 9.8
- TI-2019-08134 In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2019-11325 · CVE Program
- CVE-2019-11325 · NVD
- FIRST EPSS
- GHSA-w4rc-rx25-8m86 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences