CVE-2019-10912

unknown

Published 2020-02-12 · Modified 2024-03-13

CVSS v3

—

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

CVSS v2

—

VIR risk

—

Description

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

Predictions

Exploit likelihood

30%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2019-10912

OS impact

OS	Version	Status	Fixed in
debian	bookworm	fixed	`3.4.22+dfsg-2`
debian	bullseye	fixed	`3.4.22+dfsg-2`
debian	forky	fixed	`3.4.22+dfsg-2`
debian	sid	fixed	`3.4.22+dfsg-2`
debian	trixie	fixed	`3.4.22+dfsg-2`

Package impact

Ecosystem	Package	Vulnerable	Fixed
Packagist	symfony/cache	`>=3.1.0,<3.4.26`	`3.4.26`
Packagist	symfony/cache	`>=4.0.0,<4.1.12`	`4.1.12`
Packagist	symfony/cache	`>=4.2.0,<4.2.7`	`4.2.7`
Packagist	symfony/phpunit-bridge	`>=2.8.0,<2.8.50`	`2.8.50`
Packagist	symfony/phpunit-bridge	`>=3.0.0,<3.4.26`	`3.4.26`
Packagist	symfony/phpunit-bridge	`>=4.0.0,<4.1.12`	`4.1.12`
Packagist	symfony/phpunit-bridge	`>=4.2.0,<4.2.7`	`4.2.7`
Packagist	symfony/symfony	`>=2.8.0,<2.8.50`	`2.8.50`
Packagist	symfony/symfony	`>=3.0.0,<3.4.26`	`3.4.26`
Packagist	symfony/symfony	`>=4.0.0,<4.1.12`	`4.1.12`
Packagist	symfony/symfony	`>=4.2.0,<4.2.7`	`4.2.7`
Packagist	typo3/cms-core	`>=9.0.0,<9.5.8`	`9.5.8`
Packagist	typo3/cms	`>=9.0.0,<9.5.8`	`9.5.8`

References

Verify integrity in audit chain (admin only). AS-IS.