CVE-2019-11325

An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.

• CWE-116

• https://github.com/symfony/symfony/releases/tag/v4.3.8Release Notes, Third Party Advisory
• https://github.com/symfony/var-exporter/compare/d8bf442...57e00f3Patch, Third Party Advisory
• https://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporterVendor Advisory
• https://symfony.com/blog/symfony-4-3-8-releasedRelease Notes, Vendor Advisory
• https://github.com/symfony/symfony/releases/tag/v4.3.8Release Notes, Third Party Advisory
• https://github.com/symfony/var-exporter/compare/d8bf442...57e00f3Patch, Third Party Advisory
• https://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporterVendor Advisory
• https://symfony.com/blog/symfony-4-3-8-releasedRelease Notes, Vendor Advisory

Published

Nov 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1132An elevation of privilege vulnerability exists in Windows wh…7.8
• CVE-2019-11320In Motorola CX2 1.01 and M2 1.01, users can access the route…
• CVE-2019-11321An issue was discovered in Motorola CX2 1.01 and M2 1.01. Th…
• CVE-2019-11322An issue was discovered in Motorola CX2 1.01 and M2 1.01. Th…
• CVE-2019-11323HAProxy before 1.9.7 mishandles a reload with rotated keys, …5.9
• CVE-2019-11324The urllib3 library before 1.24.2 for Python mishandles cert…
• CVE-2019-11326An issue was discovered on Topcon Positioning Net-G5 GNSS Re…8.8
• CVE-2019-11327An issue was discovered on Topcon Positioning Net-G5 GNSS Re…4.9
• CVE-2019-11328An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a…8.8
• CVE-2019-1133A remote code execution vulnerability exists in the way that…7.5
• CVE-2019-11331Network Time Protocol (NTP), as specified in RFC 5905, uses …
• CVE-2019-11332MKCMS 5.0 allows remote attackers to take over arbitrary use…