Affected versions
Symfony HTTP Foundation versions >=5.4.50, <5.4.56, >=6.4.29, <6.4.50, >=7.3.7, <7.4.23, >=8, <8.1.11 are affected by this security issue.
The issue has been fixed in Symfony HTTP Foundation 5.4.56, 6.4.50, 7.4.23, 8.1.11.
Description
Since the fix for CVE-2025-64500, Request::getPathInfo() strips the script name from the start of the URL. It does so even when the script name is only the start of a longer path segment. With SCRIPT_NAME set to /index.php, a request to /index.phpadmin gets the path info /admin and is routed like /admin. Encoded spellings such as /index%2Ephpadmin or /%69ndex.phpadmin work too. Before that fix, the path info was admin, which no route matched.
Rules enforced by Symfony are not affected: access_control and firewalls read the same path info as the router. Rules enforced in front of PHP are. The nginx configuration of the Symfony documentation and the .htaccess file of symfony/apache-pack make /index.php/admin unreachable, but they pass /index.phpadmin to the front controller. So a location /admin block in nginx, a <Location /admin> section in Apache, or a CDN or WAF rule on /admin can be bypassed.
Resolution
The script name is now stripped only when it is followed by /, ? or the end of the URL. A request to /index.phpadmin gets the path info /index.phpadmin.
The patch for this issue is available here for branch 5.4 (and forward-ported to 6.4, 7.4, 8.1 and 8.2).
Credits
We would like to thank Nicolas Grekas for reporting the issue and Jack Worman for providing the fix.