CVE-2026-47767

Name of the Vulnerable Software and Affected Versions Symfony versions 5.4.46 through 5.4.51 Symfony versions 6.4.14 through 6.4.39 Symfony versions 7.1.7 through 7.4.11 Symfony versions 8.0.12

Description An issue exists where an unauthenticated user can modify the kernel environment and debug flag by sending a crafted query string. When register argc argv is enabled, the web SAPI builds $ SERVER['argv'] from the raw query. A discrepancy between how parse str() populates $ GET and how the web SAPI handles the query allows an attacker to keep $ GET empty while injecting flags such as --env or --no-debug into $ SERVER['argv']. The SymfonyRuntime::getInput() function then parses these flags, allowing the attacker to change APP ENV or APP DEBUG settings.

Recommendations Update Symfony to version 5.4.52. Update Symfony to version 6.4.40. Update Symfony to version 7.4.12. Update Symfony to version 8.0.12.