How severe is CVE-2025-64500?

CVE-2025-64500 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2025-64500 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (68th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-64500?

CVE-2025-64500 primarily affects Sensiolabs Httpfoundation. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2025-64500?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-64500 have an EU (EUVD) identifier?

Yes. CVE-2025-64500 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-131928.

When was CVE-2025-64500 published?

CVE-2025-64500 was published on 2025-11-12 and last updated on 2026-06-17.

CVE-2025-64500

CVE-2025-64500 is a high-severity vulnerability in Sensiolabs Httpfoundation with a CVSS 3.x base score of 7.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-647.

Key facts

Severity: High (CVSS 3.x base score 7.3)
EPSS exploit prediction: 1% (68th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-131928
Weakness: CWE-647
Affected product: Sensiolabs Httpfoundation
Published: 2025-11-12
Last modified: 2026-06-17

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.

Frequently asked questions

What is CVE-2025-64500?: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.
How severe is CVE-2025-64500?: CVE-2025-64500 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2025-64500 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (68th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-64500?: CVE-2025-64500 primarily affects Sensiolabs Httpfoundation. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-64500?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-64500 have an EU (EUVD) identifier?: Yes. CVE-2025-64500 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-131928.
When was CVE-2025-64500 published?: CVE-2025-64500 was published on 2025-11-12 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:sensiolabs:httpfoundation:*:*:*:*:*:*:*:*
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*

Other CWE-647 vulnerabilities

CVE-2022-43939 — High (CVSS 8.6): Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security…
CVE-2025-9909 — Medium (CVSS 6.7): A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows…
CVE-2026-5222 — Medium (CVSS 6.5): Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol.…
CVE-2025-66202 — Medium (CVSS 6.5): Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated…
CVE-2025-47241 — Medium (CVSS 4.0): In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be…
CVE-2025-43916 — Low (CVSS 3.4): Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing…

Browse all CWE-647 vulnerabilities →