Symfony: From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty($_GET), but parse_str() and the web… (CVE-2026-47767)

Symfony is a PHP framework used for web and console applications. A flaw exists in versions from 5.4.46 up to but not including 5.4.52, and in versions 6.4.40, 7.4.12, and 8.0.12, where the fix for CVE-2024-50340 gated runtime argv parsing based on empty($_GET). However, parse_str() and the web SAPI can disagree, allowing a crafted query string to leave $_GET empty while $_SERVER['argv'] still contains attacker-controlled flags such as --env or --no-debug. These flags can modify APP_ENV or APP_DEBUG, potentially changing application behavior. The vulnerability is addressed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

An attacker can craft a query string that bypasses the intended argv parsing restrictions, enabling them to inject command-line flags that alter critical application environment variables like APP_ENV and APP_DEBUG. This can lead to unauthorized changes in application configuration, potentially causing information disclosure, altered application behavior, or denial of service. The CVSS score of 9.8 indicates a critical impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts.

A fix is available and has been implemented in Symfony versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12. Users should upgrade to these versions or later to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official patches.