CVE-2017-16790

CVE-2017-16790 is a vulnerability in Symfony versions prior to 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5, affecting Debian and SensioLabs Symfony products. It allows an attacker to craft an HTTP request, sending a "FileType" value as normal POST data that could be interpreted as a local file path (e.g., "file:///etc/passwd"). If the application lacks additional validation, this could expose the contents of server-side files to the attacker. Rated as Medium severity (CVSS 6.5), this vulnerability has a network attack vector and low attack complexity, requiring low privileges and no user interaction. The primary impact is high confidentiality, as it allows for information disclosure. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating low public attention.