High
Security advisory
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-10912
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:45 UTC · Revision 1
Source evidence
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.
osv:CVE-2019-10912
Complete source record
{
"id": "2739808e51ad0b08a0df1e406b414ec30c0509d1dd558ec37c4e5f112afc0991",
"url": "https://osv.dev/vulnerability/CVE-2019-10912",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-10912",
"summary": "In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.",
"evidence": "osv:CVE-2019-10912",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2019-10912",
"aliases": [
"CVE-2019-10912",
"GHSA-w2fr-65vp-mxw3"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/symfony/security-http",
"type": "GIT",
"events": [
{
"introduced": "a8d5dd00894f8b5e3edb897f4504c51ddc442370"
},
{
"fixed": "7e0b49a8d10e31c0cd0431bbc99b20b6c5be4fb7"
},
{
"introduced": "33c98765dc6fec4907b7431d10e3c0945f061108"
},
{
"fixed": "58e2b17e90640c3bc80dcf0601561c6b54e4869f"
},
{
"introduced": "946668ddc1fa0279fe03e2c090ebc29881f12ddb"
},
{
"fixed": "67f6163f2efe91e586b5a6982294c6e91c70e335"
},
{
"introduced": "34e089af7d363bd2ded8ad15f06b2b97348b97e5"
},
{
"fixed": "ff2189e9921e4a88c4f621fa44444fe2b4fb1b11"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.50"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.4.0"
},
{
"fixed": "3.4.26"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.1.12"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.7"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v3.4.25",
"v2.8.49",
"v4.2.6",
"v4.2.5",
"v3.4.24",
"v3.4.23",
"v4.1.11",
"v4.2.4",
"v4.2.3",
"v3.4.22",
"v4.2.2",
"v4.1.10",
"v3.4.21",
"v4.2.1",
"v4.1.9",
"v3.4.20",
"v3.4.19",
"v4.2.0-RC1",
"v4.2.0-BETA2",
"v4.2.0",
"v4.1.8",
"v2.8.48",
"v4.1.7",
"v3.4.18",
"v2.8.47",
"v4.1.6",
"v4.1.5",
"v2.8.46",
"v3.4.17",
"v3.4.16",
"v3.4.14",
"v4.1.4",
"v3.4.15",
"v2.8.45",
"v4.1.3",
"v2.8.44",
"v4.1.2",
"v3.4.13",
"v2.8.43",
"v2.8.42",
"v3.4.12",
"v4.1.1",
"v4.1.0-BETA3",
"v4.1.0",
"v3.4.11",
"v2.8.41",
"v3.4.10",
"v2.8.40",
"v3.4.9",
"v3.4.8",
"v3.4.7",
"v3.4.6",
"v3.4.5",
"v2.8.39",
"v2.8.38",
"v2.8.37",
"v2.8.36",
"v2.8.35",
"v3.4.4",
"v2.8.34",
"v3.4.3",
"v2.8.33",
"v3.4.2",
"v3.4.1",
"v3.4.0-RC2",
"v3.4.0-RC1",
"v3.4.0",
"v2.8.32",
"v2.8.31",
"v2.8.30",
"v2.8.29",
"v2.8.28",
"v2.8.27",
"v2.8.26",
"v2.8.25",
"v2.8.24",
"v2.8.23",
"v2.8.22",
"v2.8.21",
"v2.8.20",
"v2.8.19",
"v2.8.18",
"v2.8.17",
"v2.8.16",
"v2.8.15",
"v2.8.14",
"v2.8.13",
"v2.8.12",
"v2.8.11",
"v2.8.10",
"v2.8.9",
"v2.8.8",
"v2.8.7",
"v2.8.6",
"v2.8.5",
"v2.8.4",
"v2.8.3",
"v2.8.2",
"v2.8.1",
"v2.8.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10912.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/symfony/symfony",
"type": "GIT",
"events": [
{
"introduced": "5615b92cd452cd54f1433a3f53de87c096a1107f"
},
{
"fixed": "2ef4e09343bdbdee0a7968f58b8ec594ce0aa47d"
},
{
"introduced": "0a47db379b8cc74cdd84e1e6870fafc4a4ac8351"
},
{
"fixed": "1b89e7baec9891c323bbf1ec81af77d901fc60c9"
},
{
"introduced": "58261043876feb695640457c5675bb331a6eb3b7"
},
{
"fixed": "482d06316077da115e5dac2afd2a7ce9f5f100f7"
},
{
"introduced": "7bd9a1bae87e6b2d7eba499ebf3053ff4bc3a483"
},
{
"fixed": "6122c791d640b75702514c18c8aae816dbbefae2"
},
{
"fixed": "4fb975281634b8d49ebf013af9e502e67c28816b"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.50"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.4.0"
},
{
"fixed": "3.4.26"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.1.12"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.7"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "4fb975281634b8d49ebf013af9e502e67c28816b"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2.8.49",
"v4.1.11",
"v4.2.6",
"v3.4.25",
"v4.2.5",
"v3.4.24",
"v4.2.4",
"v3.4.23",
"v4.2.3",
"v3.4.22",
"v4.2.2",
"v4.1.10",
"v3.4.21",
"v4.2.1",
"v4.1.9",
"v3.4.20",
"v2.8.48",
"v4.2.0",
"v4.1.8",
"v3.4.19",
"v4.1.7",
"v3.4.18",
"v2.8.47",
"v4.1.6",
"v3.4.17",
"v4.1.5",
"v3.4.16",
"v2.8.46",
"v4.1.4",
"v3.4.15",
"v2.8.45",
"v4.1.3",
"v3.4.14",
"v2.8.44",
"v4.1.2",
"v3.4.13",
"v2.8.43",
"v3.4.12",
"v4.1.1",
"v2.8.42",
"v4.1.0",
"v3.4.11",
"v2.8.41",
"v3.4.10",
"v2.8.40",
"v3.4.9",
"v2.8.39",
"v3.4.8",
"v2.8.38",
"v3.4.7",
"v2.8.37",
"v3.4.6",
"v2.8.36",
"v3.4.5",
"v2.8.35",
"v3.4.4",
"v2.8.34",
"v3.4.3",
"v2.8.33",
"v3.4.2",
"v3.4.1",
"v2.8.32",
"v3.4.0",
"v2.8.31",
"v2.8.30",
"v2.8.29",
"v2.8.28",
"v2.8.27",
"v2.8.26",
"v2.8.25",
"v2.8.24",
"v2.8.23",
"v2.8.22",
"v2.8.21",
"v2.8.20",
"v2.8.18",
"v2.8.19",
"v2.8.17",
"v2.8.16",
"v2.8.15",
"v2.8.14",
"v2.8.13",
"v2.8.12",
"v2.8.11",
"v2.8.10",
"v2.8.9",
"v2.8.8",
"v2.8.7",
"v2.8.6",
"v2.8.5",
"v2.8.4",
"v2.8.3",
"v2.8.2",
"v2.8.1",
"v2.8.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10912.json"
}
}
],
"modified": "2026-10-24T10:50:04.418118125Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD/",
"https://seclists.org/bugtraq/2019/May/21",
"https://symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized",
"https://typo3.org/security/advisory/typo3-core-sa-2019-016/",
"https://www.debian.org/security/2019/dsa-4441",
"https://github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-10912",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 441930,
"published_at": "2019-05-16T22:29:00.58+00:00"
}