The vulnerability in Symfony's SendmailTransport component affects versions before 5.4.52, 6.4.40, 7.4.12, and 8.0.12. When operating in -t mode, recipient addresses are appended directly to the sendmail command line without a -- separator to indicate the end of options. This allows an attacker to craft an address beginning with a dash (-) that could be interpreted as a sendmail command-line option, potentially altering sendmail's behavior. The issue is resolved by adding the proper end-of-options separator in the fixed versions.

An attacker could exploit this vulnerability by supplying a recipient address starting with a dash (-), which may be interpreted as a sendmail command-line option rather than a recipient address. This could lead to unintended command-line behavior of the sendmail process invoked by Symfony, potentially affecting mail delivery or enabling other command-line option abuses. There are no known exploits in the wild reported at this time.

A fix is available in Symfony versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12. Users should upgrade to these or later versions to remediate the vulnerability. No vendor advisory indicating alternative mitigations or no-action was provided, so upgrading is the recommended remediation.