The ServerLogCommand service in Symfony's MonologBridge listens on 0.0.0.0:9911 and deserializes every received frame using unserialize(base64_decode($message)). This process is performed without authentication, integrity verification, or an allowed_classes allowlist. Consequently, any reachable host can submit a crafted serialized PHP payload. The CVE description states the payload can crash the listener and may trigger object-injection gadget effects. Whether these gadgets lead to arbitrary code execution is not confirmed in the official advisory and is therefore inferred from the nature of the weakness. The flaw represents a PHP object deserialization vulnerability (CWE‑502) combined with improper access control (CWE‑668).

Any installation of Symfony or its MonologBridge component that has the server:log command enabled and is running a version earlier than 5.4.52, 6.4.40, 7.4.12, or 8.0.12 is vulnerable. The listener binds to 0.0.0.0:9911 by default, so systems exposed on that port are at risk.

The CVSS v3.1 score of 8.3 indicates a high severity risk because the flaw permits remote exploitation without authentication. The EPSS score is below 1 %, which suggests that exploitation attempts are currently unlikely, yet the exposed listener is a valuable target for determined actors. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires network connectivity to TCP port 9911 and the ability to send a valid base64‑encoded serialized object; local privileges are not required. The possibility of arbitrary code execution through gadget chains is inferred rather than proven, meaning the threat level depends on the existence of exploitable gadget chains in the application’s environment.