Skip to content
CVE PROGRAM SOURCE RECORD8.3 High

CVE-2026-47767

Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty($_GET), but parse_str() and the web SAPI can disagree, allowing a crafted query string to leave $_GET empty while $_SERVER['argv'] still carries attacker-controlled --env or --no-debug flags that change APP_ENV or APP_DEBUG. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

symfony symfony

  • >= 5.4.46, < 5.4.52affected
  • >= 6.4.14, < 6.4.40affected
  • >= 7.1.7, < 7.4.12affected
  • >= 8.0.0-BETA1, < 8.0.12affected

symfony runtime

  • >= 5.4.46, < 5.4.52affected
  • >= 6.4.14, < 6.4.40affected
  • >= 7.1.7, < 7.4.12affected
  • >= 8.0.0-BETA1, < 8.0.12affected

References