CVE-2026-53933 affects the maravel-framework, a PHP dependency injection framework, in versions before 10.73.1. The vulnerability arises because dynamic route placeholders (e.g., /api/v1/users/{id}) are mistakenly registered as static route keys. When an attacker sends a request with the literal placeholder syntax, the dynamic routing engine is bypassed, causing PHP 8+ to throw an ArgumentCountError and return a 500 Internal Server Error instead of a 404. This discrepancy allows an attacker to infer internal route parameter names and controller schemas by analyzing which requests cause 500 errors. The issue is classified under CWE-203 (Observable Discrepancy).

An attacker can use this vulnerability to map internal route parameter names and controller schemas by triggering and observing 500 Internal Server Errors caused by literal placeholder requests. This side-channel information disclosure can aid in reconnaissance and potentially facilitate further attacks. There is no indication of privilege escalation or direct code execution from this vulnerability.

Version 10.73.1 of maravel-framework contains a patch that fixes this vulnerability. Users should upgrade to this version or later. As a temporary workaround, implement a global middleware that rejects any requests containing literal brace patterns (e.g., '{' or '}') before they reach the routing engine to prevent the side-channel leak.