phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

2026-11-04-21: Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name

unknown Affects symfony/http-foundation, symfony/symfony. Feed 2026.11.09.1, updated 2026-11-08.

Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name

Package
symfony/http-foundation Composer
Affected versions
>=5.4.50 and <5.4.56 or >=6.4.29 and <6.4.50 or >=7.3.7 and <7.4.0 or >=7.4.0 and <7.4.23 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.1.11
Fixed in
5.4.56, 6.4.50, 7.4.23, 8.1.11
Severity
unknown
Exploitation
not on CISA KEV
Source
friendsofphp

References

Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name

Package
symfony/symfony Composer
Affected versions
>=5.4.50 and <5.4.56 or >=6.4.29 and <6.4.50 or >=7.3.7 and <7.4.0 or >=7.4.0 and <7.4.23 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.1.11
Fixed in
5.4.56, 6.4.50, 7.4.23, 8.1.11
Severity
unknown
Exploitation
not on CISA KEV
Source
friendsofphp

References

NVD recordsymfony/http-foundation advisoriessymfony/symfony advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs   How findings are ranked

Related advisories