What’s Vulnerable › Vulnerabilities
CVE-2019-18888: Argument injection in a MimeTypeGuesser in Symfony
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-11-21 · updated 2026-06-17
- Weakness: CWE-88
Description
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).
Affected products
- Fedoraproject Fedora: 30, 31
- symfony: from 2.8.0 through 2.8.50; from 3.4.0 through 3.4.34; from 4.2.0 through 4.2.11; from 4.3.0 through 4.3.7
- Packagist Symfony/Http-Foundation: from 2.0.0 before 2.8.52; from 3.0.0 before 3.4.35; from 4.0.0 before 4.2.12; from 4.3.0 before 4.3.8; 2.0.4, 2.0.5, 2.0.6, 2.0.7, v2.0.10, v2.0.12 (+393) — fixed in 2.8.52, 3.4.35, 4.2.12, 4.3.8
- Packagist Symfony/Mime: from 4.3.0 before 4.3.8; v4.3.0, v4.3.1, v4.3.2, v4.3.3, v4.3.4, v4.3.5 (+2) — fixed in 4.3.8
- Packagist Symfony/Symfony: from 2.0.0 before 2.8.52; from 3.0.0 before 3.4.35; from 4.0.0 before 4.2.12; from 4.3.0 before 4.3.8; 2.0.4, 2.0.5, 2.0.6, 2.0.7, v2.0.10, v2.0.11 (+411) — fixed in 2.8.52, 3.4.35, 4.2.12, 4.3.8
How to fix
Upgrade to a fixed version: Packagist Symfony/Http-Foundation 2.8.52, 3.4.35, 4.2.12, 4.3.8; Packagist Symfony/Mime 4.3.8; Packagist Symfony/Symfony 2.8.52, 3.4.35, 4.2.12, 4.3.8. Check the vendor advisory for mitigations.
References
- https://github.com/symfony/symfony/releases/tag/v4.3.8
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/
- https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser
- https://symfony.com/blog/symfony-4-3-8-released
- https://github.com/symfony/symfony/releases/tag/v4.3.8
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/
- https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser
- https://symfony.com/blog/symfony-4-3-8-released
Get alerted when CVE-2019-18888 or the next vulnerability affects your stack