CVE-2026-47767

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty($_GET), but parse_str() and the web SAPI can disagree, allowing a crafted query string to leave $_GET empty while $_SERVER['argv'] still carries attacker-controlled --env or --no-debug flags that change APP_ENV or APP_DEBUG. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Scoring

Severity

HIGH

CVSS base score

8.3

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS probability

0.72%

CWE

CWE-436

Published

2026-07-14

Last modified

2026-07-16

Affected products

• symfony symfony
• symfony symfony
• symfony symfony
• symfony symfony
• symfony runtime
• symfony runtime
• symfony runtime
• symfony runtime

Weakness type

• CWE-436

Related vulnerabilities

• CVE-2026-87627 — Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a...
• CVE-2026-82537 — Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch
• CVE-2026-81378 — Visual Studio Code Security Feature Bypass Vulnerability
• CVE-2026-85184 — @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target
• CVE-2026-84394 — fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
• CVE-2026-63435 — Mail: Email address spoofing via malformed RFC 2047 encoded-words
• CVE-2026-75931 — fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
• CVE-2026-57580 — authentik: Account Takeover via SAML NameID Comment Truncation

Markdown version · Browse all CVEs