websafe-kb/07-framework-security/frameworks/symfony/INDEX.md

Symfony

LAB ONLY | AUTHORIZED TARGETS ONLY | 自动生成索引

• 系统 ID: symfony
• 分类: frameworks
• 覆盖策略: rolling-24m
• 总案例数: 9
• 近 30 天新增/更新: 9
• 重点 Markdown 案例数: 9
• 已实证(真实版本): 0
• 已实证(synthetic): 0
• 阻塞数: 0
• 待人工/缺浏览器证据: 9
• 最近渲染时间: 2026-04-02T09:18:51+00:00

目标约束

• 适用目标类型: lab-local, lab-public, authorized-third-party
• 是否允许公网验证: yes, but ownership or authorization is required
• 授权前提: 资产归属可证明，或已取得书面/明确授权。
• 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
• 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作

来源

• official GitHub Global Advisories (ecosystem=composer; mode=core)
• official OSV Symfony (mode=core)

案例列表

标题	严重度	案例状态	实证状态	实证方式	来源置信度	更新时间	案例页
CSV Injection in symfony/serializer	low	generated	triage-manual	synthetic	official	2026-03-13T21:59:52.395727Z	link
Cookie persistence after password changes in symfony/security-bundle	low	generated	triage-manual	synthetic	official	2026-03-13T22:14:23.582059Z	link
Webcache Poisoning in symfony/http-kernel	low	generated	triage-manual	synthetic	official	2026-03-13T22:00:11.423907Z	link
Authentication granted to all firewalls instead of just one	low	generated	triage-manual	synthetic	official	2026-03-13T22:01:16.333089Z	link
Prevent user enumeration using Guard or the new Authenticator-based Security	low	generated	triage-manual	synthetic	official	2026-03-13T22:16:14.858636Z	link
RCE in Symfony	low	generated	triage-manual	synthetic	official	2026-03-13T22:14:38.594283Z	link
Firewall configured with unanimous strategy was not actually unanimous in Symfony	low	generated	triage-manual	synthetic	official	2026-03-13T22:16:03.504887Z	link
Exceptions displayed in non-debug configurations in Symfony	low	generated	triage-manual	synthetic	official	2026-03-13T22:15:59.230149Z	link
Prevent cache poisoning via a Response Content-Type header in Symfony	low	generated	triage-manual	synthetic	official	2026-03-13T22:01:08.748385Z	link