Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-84af4b9872 advisory.

    32.0.2 release RHBZ#2416087 RHBZ#2415750 RHBZ#2415751 RHBZ#2415752 RHBZ#2415753

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-f62aee4fe6 advisory.

    32.0.2 release RHBZ#2416087 RHBZ#2415750 RHBZ#2415751 RHBZ#2415752 RHBZ#2415753

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-7534523367 advisory.

    Automatic update for nextcloud-32.0.2-1.fc44.

    ##### **Changelog**

    ```
    * Mon Nov 24 2025 Andrew Bauer <zonexpertconsulting@outlook.com> - 32.0.2-1
    - 32.0.2 release RHBZ#2416087 RHBZ#2415750 RHBZ#2415751 RHBZ#2415752       RHBZ#2415753

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
    Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting     in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets     some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`.
    This can allow bypassing some access control rules that are built with this `/`-prefix assumption.
    Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always     start with a `/`. (CVE-2025-64500)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
277353	Fedora 43 : nextcloud (2025-84af4b9872)	Nessus	Fedora Local Security Checks	high
277349	Fedora 42 : nextcloud (2025-f62aee4fe6)	Nessus	Fedora Local Security Checks	high
276591	Fedora 44 : nextcloud (2025-7534523367)	Nessus	Fedora Local Security Checks	high
275362	Linux Distros Unpatched Vulnerability : CVE-2025-64500	Nessus	Misc.	high

Detections

Analytics

CVE-2025-64500

high

Tenable Plugins

high

high

high

high