{"id":"CVE-2019-10910","aliases":["GHSA-pgwj-prpq-jpc2"],"url":"https://o3.security/vulnerability/CVE-2019-10910","summary":"Symfony Service IDs Allow Injection","details":"In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.","published":"2019-05-16T22:29:00.407Z","modified":"2026-10-24T10:47:46.017752030Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.0595,"percentile":0.9278,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"symfony/dependency-injection","fixedVersion":"2.7.51"},{"ecosystem":"Packagist","name":"symfony/dependency-injection","fixedVersion":"2.8.50"},{"ecosystem":"Packagist","name":"symfony/dependency-injection","fixedVersion":"3.4.26"},{"ecosystem":"Packagist","name":"symfony/dependency-injection","fixedVersion":"4.1.12"},{"ecosystem":"Packagist","name":"symfony/dependency-injection","fixedVersion":"4.2.7"},{"ecosystem":"Packagist","name":"symfony/proxy-manager-bridge","fixedVersion":"2.7.51"},{"ecosystem":"Packagist","name":"symfony/proxy-manager-bridge","fixedVersion":"2.8.50"},{"ecosystem":"Packagist","name":"symfony/proxy-manager-bridge","fixedVersion":"3.4.26"},{"ecosystem":"Packagist","name":"symfony/proxy-manager-bridge","fixedVersion":"4.1.12"},{"ecosystem":"Packagist","name":"symfony/proxy-manager-bridge","fixedVersion":"4.2.7"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"2.7.51"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"2.8.50"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"3.4.26"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"4.1.12"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"4.2.7"}],"fix":{"url":"https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b","label":"symfony/symfony@d2fb589"},"references":[{"type":"ADVISORY","url":"https://www.synology.com/security/advisory/Synology_SA_19_19"},{"type":"FIX","url":"https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b"},{"type":"EVIDENCE","url":"https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10910"},{"type":"WEB","url":"https://github.com/symfony/symfony/commit/3876c75f858d5d82e2c309698d21af2f1d721afb"},{"type":"WEB","url":"https://github.com/symfony/symfony/commit/4c80c3444854ef384df94deb4acbcef4b5e5243b"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/dependency-injection/CVE-2019-10910.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/proxy-manager-bridge/CVE-2019-10910.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10910.yaml"},{"type":"PACKAGE","url":"https://github.com/symfony/symfony"},{"type":"WEB","url":"https://symfony.com/cve-2019-10910"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:47:46.017752030Z"}}