Got a security vulnerabilty after updating a composer package

I got this message after updating a package. What should I do?


Package	symfony/http-foundation
Severity	high
CVE	CVE-2025-64500
Title	CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
URL	https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass
Affected versions	>=2.0.0,<3.0.0
Reported at	2025-11-12T11:09:14+00:00

Best Answer

Level 73

I would start by running composer update, since that will most likely handle the issue.

If it doesn't check the GitHub page for the project, and see if they implemented a fix for it.

2 likes

Level 80

@chron What version of Laravel are you running? Versions 2 and 3 of symfony/http-foundation are absolutely ancient! The current version of that package is 8: https://packagist.org/packages/symfony/http-foundation

1 like

Level 6

I'm using Laravel 12

$ sail artisan about

Storage
public/storage	LINKED

1 like

Please or to participate in this conversation.