Sensiolabs vulnerabilities
We track 10 vulnerabilities in Sensiolabs products across 2 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on November 6, 2026.
Latest Sensiolabs vulnerabilities
- 8.4 High severity
symfony: External Control of File Name or Path
The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass such as UploadedFile, ObjectNormalizer instantiates the object through its constructor from attacker-c
- 8.7 High severity
symfony: Inefficient Algorithmic Complexity
The Symfony Yaml components Inline and Parser, parse some YAML documents inefficiently, so that a small crafted document can take disproportionately long to process, keeping a PHP process busy for seconds or minutes, potentially causing a denial of service in
- 8.2 High severity
symfony: Improper Limitation of a Pathname to a Restricted Directory
The Symfony Serializer component DataUriNormalizer::denormalize() matches the data: scheme with a case-sensitive regular expression, allowing a value with an uppercase scheme, such as DATA:,/../../../etc/passwd, to bypass it, resulting in Arbitrary Local File
- 8.2 High severity
symfony: Exposure of Sensitive Information to an Unauthorized Actor
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such as "//evil.example/ste
- 7.7 High severity
symfony: Authentication Bypass by Spoofing
Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted
- 8.7 High severity
symfony: Uncontrolled Recursion
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals
- 8.7 High severity
symfony: Uncontrolled Recursion
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of th
- 8.7 High severity
symfony: Inefficient Regular Expression Complexity
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, fol
- 7.3 High severity
symfony: Use of Non-Canonical URL Paths for Authorization Decisions
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and
- 7.3 High severity
symfony: Improper Neutralization of Special Elements in Output Used by a Downstream Component
symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to ch