CVE-2026-47767

Critical · CVSS 9.8

symfony/runtime — Interpretation Conflict / Query String Bypass leading to environment variable injection (APP_ENV/APP_DEBUG flag manipulation via argv)

CVSS: 9.8; nvd
EPSS: 0.33%; 25th pct
KEV: No
Class: oss containerizable; CWE-436

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty($_GET), but parse_str() and the web SAPI can disagree, allowing a crafted query string to leave $_GET empty while $_SERVER['argv'] still carries attacker-controlled --env or --no-debug flags that change APP_ENV or APP_DEBUG. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Search profile — drives PoC discovery

Symbols empty($_GET)parse_str$_SERVER['argv']--env--no-debugAPP_ENVAPP_DEBUGargv parsingruntime argvCVE-2024-503403228c3806ee511008bea19a95084d460b17e5d25

Keywords CVE-2026-47767symfony runtime argv bypasssymfony APP_ENV injectionsymfony query string parse_str bypasssymfony --env flag injectionsymfony CVE-2024-50340 bypasssymfony empty GET argvsymfony runtime environment manipulationsymfony APP_DEBUG bypasssymfony/runtime PoC

Versions: 5.4.46 - 5.4.51, 6.4.x < 6.4.40, 7.4.x < 7.4.12, 8.0.x < 8.0.12

Affected packages

Packagist	symfony/runtime	5.4.46 → 5.4.52
Packagist	symfony/runtime	6.4.14 → 6.4.40
Packagist	symfony/runtime	7.1.7 → 7.4.12
Packagist	symfony/runtime	8.0.0 → 8.0.12
Packagist	symfony/symfony	5.4.46 → 5.4.52
Packagist	symfony/symfony	6.4.14 → 6.4.40
Packagist	symfony/symfony	7.1.7 → 7.4.12
Packagist	symfony/symfony	8.0.0 → 8.0.12

References

Status: enriched · ingested 2026-07-15T18:00:20.000Z · profiled 2026-07-15T18:30:20.000Z