Critical severity9.6NVD Advisory· Published Aug 20, 2020· Updated Jun 17, 2026
CVE-2020-15146
CVE-2020-15146
Description
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sylius/resource-bundlePackagist | >= 1.4.0, < 1.4.7 | 1.4.7 |
sylius/resource-bundlePackagist | >= 1.5.0, < 1.5.2 | 1.5.2 |
sylius/resource-bundlePackagist | >= 1.6.0, < 1.6.4 | 1.6.4 |
sylius/resource-bundlePackagist | >= 1.0.0, < 1.3.14 | 1.3.14 |
Affected products
3- Sylius/SyliusResourceBundlev5Range: < 1.3.14
Patches
Vulnerability mechanics
References
5- github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-h6m7-j4h3-9rf5nvdExploitMitigationThird Party AdvisoryWEB
- github.com/advisories/GHSA-h6m7-j4h3-9rf5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-15146ghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-15146.yamlghsaWEB
- github.com/Sylius/SyliusResourceBundle/commit/73d9aba182947473a5935b31caf65ca263091e00ghsaWEB
News mentions
0No linked articles in our index yet.