CVE-2026-47767
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability in Symfony allows an attacker to manipulate the APP_ENV and APP_DEBUG environment variables via a crafted query string that bypasses the protection introduced in CVE-2024-50340. The issue stems from a discrepancy between parse_str() and the web SAPI, enabling attacker-controlled --env or --no-debug flags to be passed to the script.
Risk Assessment
An attacker can change the application's runtime environment (e.g., enable debug mode), potentially leading to disclosure of sensitive information, configuration errors, or enabling further attacks on the application.
Recommendation
Immediately upgrade Symfony to version 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on the branch in use. After the update, test the application to ensure proper functionality.
Original NVD description (English source)
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty($_GET), but parse_str() and the web SAPI can disagree, allowing a crafted query string to leave $_GET empty while $_SERVER['argv'] still carries attacker-controlled --env or --no-debug flags that change APP_ENV or APP_DEBUG. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.