# CVE-2025-64500: Symfony - Improper Access Control

> Live exploitation tracking for CVE-2025-64500 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-64500

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.3
- **Public exploit available:** Yes
- **Affected products:** Symfony
- **Weaknesses:** CWE-647 (Use of Non-Canonical URL Paths for Authorization Decisions)
- **Tags:** php, web_application

## Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.

## CrowdSec analysis

[CVE-2025-64500](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-64500) is an improper access control vulnerability in Symfony's HttpFoundation component, affecting versions 2.0.0 through 7.3.6. Due to incorrect handling of certain PATH_INFO values, attackers could craft URLs that bypass access control rules relying on paths starting with a `/`, potentially granting unauthorized access to restricted resources. This flaw could be exploited in web applications to circumvent security policies and access sensitive endpoints.

CrowdSec has been tracking this vulnerability and its exploits since 22nd of May 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-64500 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-64500 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-64500 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit this vulnerability by crafting requests to URLs such as `/index.php_profiler/` or `/app.php_profiler/`, leveraging malformed PATH_INFO segments to bypass Symfony's access control and gain unauthorized access to restricted endpoints like the Symfony Profiler.

## Timeline

- 2025-11-12: CVE Published. CVE-2025-64500 is published to NVD.
- 2026-05-22: Rule Released. CrowdSec releases a rule to detect CVE-2025-64500 exploitation attempts against the CrowdSec Network.
- 2026-05-27: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-64500 for the first time.

## References

- https://github.com/symfony/symfony/security/advisories/GHSA-3rg7-wf37-54rm
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2025-64500.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2025-64500.yaml
- https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass
- https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64500.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-64500) follows observed exploitation activity for CVE-2025-64500. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.