CVE-2026-47767 Details
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty($_GET), but parse_str() and the web SAPI can disagree, allowing a crafted query string to leave $_GET empty while $_SERVER['argv'] still carries attacker-controlled --env or --no-debug flags that change APP_ENV or APP_DEBUG. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
A vulnerability exists in Symfony's runtime component that can be exploited to manipulate application environment variables. This issue arises in Symfony versions 5.4.46 prior to 5.4.52, 6.4.14 prior to 6.4.40, 7.1.7 prior to 7.4.12, and 8.0.0 prior to 8.0.12. The vulnerability exploits a mismatch between how the web server and the 'parse_str()' function handle query strings, allowing an attacker to send crafted flags that alter the 'APP_ENV' and 'APP_DEBUG' variables. The problem is exacerbated when the 'register_argc_argv' directive is enabled, as it allows the server to pass these flags through '$_SERVER['argv']' to the application.
Users can upgrade to Symfony versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/symfony/symfony/commit/3228c3806ee511008bea19a95084d460b17e5d25 | [email protected] | Patch |
| https://github.com/symfony/symfony/releases/tag/v5.4.52 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/releases/tag/v6.4.40 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/releases/tag/v7.4.12 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/releases/tag/v8.0.12 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/security/advisories/GHSA-fqc7-9xjw-jrh3 | [email protected] | Not Applicable |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-436 | Interpretation Conflict | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sensiolabs symfony | >= 5.4.46, < 5.4.52 >= 6.4.14, < 6.4.40 >= 7.1.7, < 7.4.12 >= 8.0.0, < 8.0.12 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | New CVE Received | [email protected] |