CVE-2026-24739
BaseFortify
Publication date: 2026-01-28
Last updated on: 2026-02-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sensiolabs | symfony | to 5.4.51 (exc) |
| sensiolabs | symfony | From 6.4.0 (inc) to 6.4.33 (exc) |
| sensiolabs | symfony | From 7.3.0 (inc) to 7.3.11 (exc) |
| sensiolabs | symfony | From 7.4.0 (inc) to 7.4.5 (exc) |
| sensiolabs | symfony | From 8.0.0 (inc) to 8.0.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-88 | The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the Symfony Process component on Windows when PHP is run from an MSYS2-based environment like Git Bash. The component did not correctly treat certain characters (notably '=') as special when escaping arguments. As a result, MSYS2's argument/path conversion can corrupt or truncate arguments passed to native Windows executables, causing the spawned process to receive altered arguments. This can lead to unintended operations, such as deleting broader directories than intended if file-management commands are invoked with paths containing '='.
How can this vulnerability impact me? :
If you use Symfony Process to spawn native Windows executables from an MSYS2-based shell and pass arguments containing '=' or similar characters, the arguments may be corrupted or truncated. This can cause commands like file deletions to operate on unintended paths, potentially deleting more data than intended. The risk is higher if untrusted input influences these arguments, leading to possible data loss or unintended system modifications.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, avoid running PHP or your own tooling from MSYS2-based shells on Windows; instead, use cmd.exe or PowerShell for workflows that spawn native executables. Avoid passing paths containing '=' or similar MSYS2-sensitive characters to Symfony Process when operating under Git Bash/MSYS2. Additionally, where applicable, configure MSYS2 to disable or restrict argument conversion by setting the MSYS2_ARG_CONV_EXCL environment variable, understanding this may affect other tooling behavior. Also, update Symfony Process component to versions 5.4.51, 6.4.33, 7.3.11, 7.4.5, or 8.0.5 which contain patches for this issue.