CVE-2026-45068

Analyzed Analyzed - Analysis Complete

Sendmail Command Injection in Symfony Framework

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mode appended recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address beginning with - to be interpreted as a sendmail command-line option instead of an address. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-45068

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 7.0.0 (inc) to 7.4.12 (exc)
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.12 (exc)
sensiolabs	symfony	to 5.4.52 (exc)
sensiolabs	symfony	From 6.0.0 (inc) to 6.4.40 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

This is an argument injection vulnerability in Symfony's SendmailTransport component. When recipient email addresses starting with a dash (-) are passed to the sendmail binary in -t mode, they are incorrectly interpreted as command-line options instead of email addresses. This happens because the SendmailTransport does not include a -- end-of-options separator before the recipient list.

Detection Guidance

Check Symfony Mailer versions with: composer show symfony/mailer. If using versions before 5.4.52, 6.4.40, 7.4.12, or 8.0.12, the system is vulnerable. Inspect application logs for sendmail command execution patterns where recipient addresses starting with - may appear.

Impact Analysis

An attacker could exploit this to inject malicious command-line options into the sendmail command, potentially leading to unauthorized actions, data exfiltration, or system compromise. The impact depends on the privileges of the web application user.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations must patch to maintain compliance.

Mitigation Strategies

Upgrade Symfony Mailer to versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 or later. If immediate upgrade is not possible, review and sanitize all recipient addresses in your application to ensure they do not start with a dash (-).

Hi! I’m here to help you understand CVE-2026-45068. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70