Have found a security issue in Symfony? Send the details to
security [at] symfony.com and don't
disclose it publicly until we can provide a fix for it.
Manage your notification preferences to receive an email as soon as a Symfony security release is published.
Sandbox does not protect against resource exhaustion
May 20, 2026
#Security Advisories
Possible sandbox bypass when using a source policy
May 20, 2026
#Security Advisories
CVE-2026-24739: Incorrect argument escaping under MSYS2/Git Bash on Windows can lead to destructive file operations
January 28, 2026
#Security Advisories
❤️ 1
CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
November 12, 2025
#Security Advisories
👀 5
👍 7
🎉 1
Symfony UX CVE-2025-47946: Unsanitized HTML attribute injection via ComponentAttributes
May 19, 2025
#Security Advisories
👍 2
Twig CVE-2025-24374: Missing output escaping for the null coalesce operator
January 29, 2025
#Security Advisories
👍 1
Update for CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient
November 13, 2024
#Security Advisories
❤️ 1
CVE-2024-51996: Authentication Bypass via persisted RememberMe cookie
November 13, 2024
#Security Advisories
👀 2
👍 4
🚀 1
Twig CVE-2024-51755: Unguarded calls to __isset() and to array-accesses in a sandbox
November 6, 2024
#Security Advisories
👀 1