{"action":"Upgrade symfony to 4.3.8+dfsg-1 or later.","affected":[{"fixed":"4.3.8+dfsg-1","introduced":"0"}],"component":"symfony","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["4.3.8+dfsg-1"],"id":"tcs_01M5NE1TMK5ZFH7TGPD0YT2CP1","modified_at":"2026-09-21T07:03:12.557440920Z","published_at":"2019-11-21T23:15:13.530Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2019-18888","https://security-tracker.debian.org/tracker/CVE-2019-18888"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2019-18888#Debian:13/symfony","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2019-18888"}],"summary":"An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME"}