An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint `string` in a setter method (e.g. `setName(string $name)`) of a class that's the `data_class` of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then `UploadedFile::__toString()` is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution.
2018-12-18T22:29:04.947
2024-11-21T03:58:33.627
Modified
CVSSv3.0: 5.3 (MEDIUM)
AV:N/AC:L/Au:N/C:P/I:N/A:N
10.0
2.9
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | sensiolabs | symfony | < 2.7.50 | Yes |
| Application | sensiolabs | symfony | < 2.8.49 | Yes |
| Application | sensiolabs | symfony | < 3.4.20 | Yes |
| Application | sensiolabs | symfony | < 4.0.15 | Yes |
| Application | sensiolabs | symfony | < 4.1.9 | Yes |
| Application | sensiolabs | symfony | < 4.2.1 | Yes |
| Operating System | debian | debian_linux | 8.0 | Yes |