CVE-2019-18888:
Argument injection in a MimeTypeGuesser in Symfony
7.5
CVSS ScoreBasic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
Published
12/2/2019
Updated
2/1/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| symfony/http-foundation | composer | >= 2.0.0, < 2.8.52 | 2.8.52 |
| symfony/http-foundation | composer | >= 3.0.0, < 3.4.35 | 3.4.35 |
| symfony/http-foundation | composer | >= 4.0.0, < 4.2.12 | 4.2.12 |
| symfony/http-foundation | composer | >= 4.3.0, < 4.3.8 | 4.3.8 |
| symfony/mime | composer | >= 4.3.0, < 4.3.8 | 4.3.8 |
| symfony/symfony | composer | >= 2.0.0, < 2.8.52 | 2.8.52 |
| symfony/symfony | composer | >= 3.0.0, < 3.4.35 | 3.4.35 |
| symfony/symfony | composer | >= 4.0.0, < 4.2.12 | 4.2.12 |
| symfony/symfony | composer | >= 4.3.0, < 4.3.8 | 4.3.8 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability exists in the MIME type guessing logic that passes user-controlled filenames to the 'file' command. Both HttpFoundation and Mime components contained FileBinaryMimeTypeGuesser implementations that failed to properly escape filenames starting with dashes. The security patches modified these guesser implementations to add proper argument escaping, as evidenced by Symfony's release notes mentioning 'fix guessing mime-types of files with leading dash'. These functions would appear in stack traces when processing malicious filenames during MIME type detection.