{"id":"CVE-2019-10910","aliases":["GHSA-pgwj-prpq-jpc2"],"url":"https://o3.security/vulnerability/CVE-2019-10910","summary":"Symfony Service IDs Allow Injection","details":"In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.","published":"2019-05-16T22:29:00.407Z","modified":"2026-08-07T14:48:27.416720Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.0595,"percentile":0.9278,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"symfony/dependency-injection","fixedVersion":"2.7.51"},{"ecosystem":"Packagist","name":"symfony/dependency-injection","fixedVersion":"2.8.50"},{"ecosystem":"Packagist","name":"symfony/dependency-injection","fixedVersion":"3.4.26"},{"ecosystem":"Packagist","name":"symfony/dependency-injection","fixedVersion":"4.1.12"},{"ecosystem":"Packagist","name":"symfony/dependency-injection","fixedVersion":"4.2.7"},{"ecosystem":"Packagist","name":"symfony/proxy-manager-bridge","fixedVersion":"2.7.51"},{"ecosystem":"Packagist","name":"symfony/proxy-manager-bridge","fixedVersion":"2.8.50"},{"ecosystem":"Packagist","name":"symfony/proxy-manager-bridge","fixedVersion":"3.4.26"},{"ecosystem":"Packagist","name":"symfony/proxy-manager-bridge","fixedVersion":"4.1.12"},{"ecosystem":"Packagist","name":"symfony/proxy-manager-bridge","fixedVersion":"4.2.7"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"2.7.51"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"2.8.50"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"3.4.26"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"4.1.12"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"4.2.7"}],"fix":{"url":"https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b","label":"symfony/symfony@d2fb589"},"references":[{"type":"ADVISORY","url":"https://www.synology.com/security/advisory/Synology_SA_19_19"},{"type":"FIX","url":"https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b"},{"type":"EVIDENCE","url":"https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T14:48:27.416720Z"}}