CVE-2019-11325

9.8 criticalEPSS 3.4%

Critical (9.8) in sensiolabs symfony. EPSS 3.4% chance of exploitation in the next 30 days.

An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWE: CWE-116
Published: 2019-11-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sensiolabs:symfony

References

https://github.com/symfony/symfony/releases/tag/v4.3.8
https://github.com/symfony/var-exporter/compare/d8bf442...57e00f3
https://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporter
https://symfony.com/blog/symfony-4-3-8-released
https://github.com/symfony/symfony/releases/tag/v4.3.8

Check your stack JSON