CVE-2019-10912: Sensiolabs Symfony

High severity, CVSS 7.1. EPSS: 2.3% chance of exploitation in the next 30 days.

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

Affected products

• Sensiolabs Symfony: from 2.8.0, before 2.8.50 (fixed in 2.8.50); from 3.4.0, before 3.4.26 (fixed in 3.4.26); from 4.1.0, before 4.1.12 (fixed in 4.1.12); from 4.2.0, before 4.2.7 (fixed in 4.2.7)

Published 2019-05-16. Last modified 2026-06-17.