Symfony - Improper Access Control (CVE-2025-64500)

CVE-2025-64500 is an improper access control vulnerability in Symfony's HttpFoundation component, affecting versions 2.0.0 through 7.3.6. Due to incorrect handling of certain PATH_INFO values, attackers could craft URLs that bypass access control rules relying on paths starting with a /, potentially granting unauthorized access to restricted resources. This flaw could be exploited in web applications to circumvent security policies and access sensitive endpoints.

CrowdSec has been tracking this vulnerability and its exploits since 22nd of May 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-64500 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-64500 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-64500 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit this vulnerability by crafting requests to URLs such as /index.php_profiler/ or /app.php_profiler/, leveraging malformed PATH_INFO segments to bypass Symfony's access control and gain unauthorized access to restricted endpoints like the Symfony Profiler.