-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| symfony/symfony | composer | >= 2.0.0, < 2.0.22 | 2.0.22 |
| symfony/yaml | composer | >= 2.0.0, < 2.0.22 | 2.0.22 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how Yaml::parse() handled file inputs. In versions <2.0.22, when the input was a filename (detected via is_file()), it would execute include($input) without any safeguards. The commit diff shows the patch added a check for $enablePhpParsing (defaulting to false after patch) before using include(). The advisory explicitly states PHP file execution via Yaml::parse() was possible when PHP parsing was enabled by default in vulnerable versions.