CVE-2026-47767

Analyzed Analyzed - Analysis Complete

Command Injection in Symfony PHP Framework

Publication date: 2026-07-14

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty($_GET), but parse_str() and the web SAPI can disagree, allowing a crafted query string to leave $_GET empty while $_SERVER['argv'] still carries attacker-controlled --env or --no-debug flags that change APP_ENV or APP_DEBUG. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-47767

EUVD

EUVD-2026-44349

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.12 (exc)
sensiolabs	symfony	From 5.4.46 (inc) to 5.4.52 (exc)
sensiolabs	symfony	From 6.4.14 (inc) to 6.4.40 (exc)
sensiolabs	symfony	From 7.1.7 (inc) to 7.4.12 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-436	Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

Executive Summary

This vulnerability affects Symfony, a PHP web framework, where a previous security fix (CVE-2024-50340) was bypassed. Attackers could manipulate environment variables APP_ENV and APP_DEBUG via a crafted query string in a web request. The issue occurs because parse_str() and the web SAPI handle query strings differently, allowing an empty $_GET while $_SERVER['argv'] still contains attacker-controlled flags.

Detection Guidance

To detect this vulnerability, check if your Symfony application is running versions between 5.4.46-5.4.51, 6.4.14-6.4.39, 7.1.7-7.4.11, or 8.0.0-8.0.11. Inspect web server logs for unusual GET requests containing query strings that might manipulate APP_ENV or APP_DEBUG. Verify if register_argc_argv is enabled in PHP configuration.

Impact Analysis

An attacker could exploit this to alter application settings like environment mode or debug settings, potentially leading to unauthorized access, data leaks, or application misbehavior. This is especially risky if the application handles sensitive data or operates in production environments.

Compliance Impact

This vulnerability could lead to unauthorized changes in application behavior, potentially violating data protection requirements under GDPR or HIPAA. If exploited, it may result in unauthorized access to personal or health data, leading to compliance breaches and legal consequences.

Mitigation Strategies

Immediately update Symfony to versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 or later. Disable register_argc_argv in PHP configuration if not required. Review and restrict access to environment variable modification endpoints. Monitor for suspicious GET requests in web server logs.

Hi! I’m here to help you understand CVE-2026-47767. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70