Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Symfony (symfony/symfony) versions 4.2.0 to before 4.2.12 and 4.3.0 to before 4.3.8, and symfony/var-exporter in the same ranges, are affected. The VarExport component escapes certain specially crafted strings incorrectly, which can let an attacker run arbitrary PHP code; the source does not describe what access or conditions an attacker needs. Upgrade symfony/symfony and symfony/var-exporter to 4.2.12, 4.3.8 or later.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 9.8 | Critical | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS 0.034, the 88th percentile, on 10 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:33 UTC First seen by agentprime
- 31 Oct 2026, 14:33 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-w4rc-rx25-8m86
- OSV: GHSA-w4rc-rx25-8m86
- nvd.nist.gov/vuln/detail/CVE-2019-11325
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-11325.yaml
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/var-exporter/CVE-2019-11325.yaml
- github.com/symfony/symfony/releases/tag/v4.3.8
- github.com/symfony/var-exporter/compare/d8bf442...57e00f3
- symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporter
- symfony.com/blog/symfony-4-3-8-released
- symfony.com/cve-2019-11325