Description
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | symfony | 3.4.22+dfsg-2 | — |
| Debian 13 | symfony | 3.4.22+dfsg-2 | — |
| Debian 12 | symfony | 3.4.22+dfsg-2 | — |
| Debian 9 | symfony | 2.8.7+dfsg-1.3+deb9u2 | DSA-4441-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | symfony | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | symfony/cache | >= 3.1.0, < 3.4.26 | 3.4.26 | GHSA-w2fr-65vp-mxw3 |
| Packagist | symfony/cache | >= 4.0.0, < 4.1.12 | 4.1.12 | GHSA-w2fr-65vp-mxw3 |
| Packagist | symfony/cache | >= 4.2.0, < 4.2.7 | 4.2.7 | GHSA-w2fr-65vp-mxw3 |
| Packagist | symfony/phpunit-bridge | >= 2.8.0, < 2.8.50 | 2.8.50 | GHSA-w2fr-65vp-mxw3 |
| Packagist | symfony/phpunit-bridge | >= 3.0.0, < 3.4.26 | 3.4.26 | GHSA-w2fr-65vp-mxw3 |
| Packagist | symfony/phpunit-bridge | >= 4.0.0, < 4.1.12 | 4.1.12 | GHSA-w2fr-65vp-mxw3 |
| Packagist | symfony/phpunit-bridge | >= 4.2.0, < 4.2.7 | 4.2.7 | GHSA-w2fr-65vp-mxw3 |
| Packagist | symfony/symfony | >= 2.8.0, < 2.8.50 | 2.8.50 | GHSA-w2fr-65vp-mxw3 |
| Packagist | symfony/symfony | >= 3.0.0, < 3.4.26 | 3.4.26 | GHSA-w2fr-65vp-mxw3 |
| Packagist | symfony/symfony | >= 4.0.0, < 4.1.12 | 4.1.12 | GHSA-w2fr-65vp-mxw3 |
| Packagist | symfony/symfony | >= 4.2.0, < 4.2.7 | 4.2.7 | GHSA-w2fr-65vp-mxw3 |
| Packagist | typo3/cms | >= 9.0.0, < 9.5.8 | 9.5.8 | GHSA-w2fr-65vp-mxw3 |
| Packagist | typo3/cms-core | >= 9.0.0, < 9.5.8 | 9.5.8 | GHSA-w2fr-65vp-mxw3 |
Advisories 1
- DSA-4441-1 symfony - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized
- FEDORA-2019-0ef4149687 vendor-advisory
- FEDORA-2019-f5d6a7ce74 vendor-advisory
- FEDORA-2019-2a7f472198 vendor-advisory
- FEDORA-2019-8635280de5 vendor-advisory
- FEDORA-2019-3ee6a7adf2 vendor-advisory
- FEDORA-2019-a3ca65028c vendor-advisory
- FEDORA-2019-f8db687840 vendor-advisory
- FEDORA-2019-32067d8b15 vendor-advisory
- DSA-4441 vendor-advisory
- 20190510 [SECURITY] [DSA 4441-1] symfony security update mailing-list
- https://github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b
- https://typo3.org/security/advisory/typo3-core-sa-2019-016/