Symfony Mime vulnerabilities

CVE-2019-18888 [HIGH] CWE-20 Argument injection in a MimeTypeGuesser in Symfony Argument injection in a MimeTypeGuesser in Symfony An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x

CVE-2026-45070 [MEDIUM] CWE-93 CVE-2026-45070: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Mime\Header\ParameterizedHeader validates and encodes parameter values but emits parameter names verbatim, allowing a caller that derives a parameter name from untrusted input to include CRLF

CVE-2026-45067 [HIGH] CWE-93 Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address ### Description `Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The const