| Snyk

Threat Intelligence

0.59% (79^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Unrestricted Upload of File with Dangerous Type vulnerabilities in an interactive lesson.

Start learning

Snyk IDSNYK-DEBIANUNSTABLE-SYMFONY-321074
published7 Dec 2018
disclosed18 Dec 2018

Report a new vulnerability Found a mistake?

Introduced: 7 Dec 2018

CVE-2018-19789 (opens in a new tab) CWE-434 (opens in a new tab)

How to fix?

Upgrade Debian:unstable symfony to version 3.4.20+dfsg-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream symfony package and not the symfony package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint string in a setter method (e.g. setName(string $name)) of a class that's the data_class of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then UploadedFile::__toString() is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution.

Unrestricted Upload of File with Dangerous Type Affecting symfony package, versions <3.4.20+dfsg-1

Severity