Skip to content
OpenAdvisories

Package · Packagist

symfony/mime

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.3
    CVE-2026-45070

    Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Mime\Header\ParameterizedHeader validates and encodes parameter values but emits parameter names v…

    symfony symfony mime nextcloud-server-33 Debian Ubuntu Wolfi Packagist
  • Medium 6.3
    CVE-2026-45067 Public exploit

    Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

    ### Description `Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a secur…

    symfony symfony nextcloud-server-33 symfony/symfony Debian Ubuntu Wolfi Packagist
  • High 7.5
    CVE-2019-18888

    Argument injection in a MimeTypeGuesser in Symfony

    An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are…

    symfony/symfony symfony symfony symfony/http-foundation Debian Ubuntu Packagist