Threats tagged 'ghsa-3rg7-wf37-54rm'

Symfony's HttpFoundation component contains a vulnerability in the Request class where incorrect parsing of PATH_INFO can cause URL paths to be represented without a leading '/'. This flaw can lead to limited authorization bypass in access control rules that assume paths start with '/'. The issue affects multiple versions of symfony/http-foundation prior to fixed releases. A patch is available that ensures URL paths always start with '/'.