What is the CVSS score of CVE-2026-45068?

CVE-2026-45068 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-45068?

Within 24 hours: identify all applications using symfony/mailer or symfony/symfony in production and staging, and confirm which major versions are deployed. Within 7 days: upgrade symfony/mailer to version 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on your current version line, prioritizing production environments where SendmailTransport is enabled. Within 30 days: complete regression testing of email delivery workflows, validate sendmail configuration (particularly -t mode usage), and document the patch deployment with version numbers applied.

Symfony Mailer CVE-2026-45068

Q: Which versions of Symfony Mailer are affected by CVE-2026-45068?

Symfony Mailer's SendmailTransport contains an argument injection vulnerability (CVE-2026-45068) that allows attackers controlling recipient addresses to inject sendmail command-line flags,…. A patch is available.

EUVD-2026-44370 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-05-27 https://github.com/symfony/symfony

GHSA-xx3c-qf5g-hc39

Information Disclosure

8.7

CVSS 4.0 · Vendor: https://github.com/symfony/symfony

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify app passing user input as mail recipient
Delivery

Submit recipient beginning with '-'
Exploit

Address flows to sendmail '-t' invocation
Execution

sendmail parses value as command-line option
Impact

Attacker manipulates sendmail behavior / file write

Vulnerability Assessment

Weakness	CWE CWE-88 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Argument sanitization
Exploitation Conditions	Exploitation requires SendmailTransport to be running in `-t` mode (recipients passed as command-line arguments) - this is NOT the Symfony default, which is `-bs` (SMTP over stdin) and is unaffected. It also requires that the application allow an attacker to control or influence a recipient address so that a value beginning with `-` (accepted as valid by Symfony\Component\Mime\Address) reaches the sendmail invocation. The primary limiting factors are therefore: the non-default `-t` transport configuration, the presence of an application code path that passes untrusted input as a recipient, and a locally installed sendmail binary that interprets leading-dash arguments as options. The CVSS vector shows PR:N/UI:N (no authentication or user interaction required by the metric itself), but these configuration and data-flow prerequisites meaningfully narrow real-world exploitability.
Impact	Signals are mixed and lean toward moderate-in-practice despite the High headline score. The NVD CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) yields 8.7 by treating the flaw as remotely reachable with no privileges and high integrity impact and zero confidentiality/availability impact. However, real-world exploitability is gated by two conditions not reflected in the raw vector: the transport must be configured in the non-default `-t` mode, and the application must pass attacker-influenced data as a recipient address. EPSS is very low (0.06%, 20th percentile), there is no KEV listing and no POC referenced, which is consistent with a config-dependent, not-yet-weaponized issue. Note a data conflict worth flagging: the intelligence Tags label this 'Information Disclosure', yet the CVSS vector sets VC:N (no confidentiality impact) and VI:H (integrity only) - the CVSS integrity framing is the better fit for an argument-injection bug that alters the sendmail command, so the 'Information Disclosure' tag should be treated with skepticism. Overall this is a real but conditional issue: patch on a normal cycle rather than as an emergency, prioritizing systems that use sendmail `-t` with externally supplied recipients.
Exploit ScenarioDerived	An application lets users supply an email address (for example a 'send to a friend' or notification field) and delivers via Symfony Mailer configured with sendmail in `-t` mode. An attacker submits a recipient like `-Config=/attacker/path` or `-X/var/www/html/shell.log`, which sendmail parses as an option instead of an address, letting the attacker influence sendmail's behavior such as writing to attacker-chosen files. No public exploit code is referenced for this CVE, and success depends on the non-default `-t` configuration and the network reachability implied by the CVSS AV:N vector.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Jul 14, 2026

Argument (option) injection in Symfony Mailer's SendmailTransport lets a dash-prefixed recipient address be interpreted as a sendmail command-line flag, allowing an attacker who controls a recipient value to manipulate how the local sendmail binary is invoked. It affects symfony/mailer (and the monolithic symfony/symfony) before 5.4.52, 6.4.40, 7.4.12 and 8.0.12 when the transport runs in -t mode. No public exploit identified at time of analysis; EPSS is low (0.06%, 20th percentile) and the issue is not in CISA KEV, but the NVD CVSS 4.0 score is 8.7 (High) driven by a high integrity impact.

Earlier versions of this analysis (1)

v1 May 27, 2026 - 23:19

Argument injection in Symfony Mailer's SendmailTransport component allows an attacker who controls recipient email addresses to inject arbitrary sendmail command-line options when the transport operates in -t mode. The flaw affects symfony/mailer and symfony/symfony across the 5.4, 6.x, and 7.x branches, with fixed releases confirmed at 5.4.52, 6.4.40, and 7.4.12. No public exploit code or CISA KEV listing exists at time of analysis, but the vulnerability is exploitable wherever application logic permits user-influenced recipient addresses and -t mode is configured.

RemediationAI

Vendor-released patch: upgrade to symfony/mailer (or symfony/symfony) 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on your release line, via composer update symfony/mailer - this adds the -- end-of-options separator before recipients (commit c45144862dc289d03952f41f6078174089a3afc6). Consult the advisory at https://github.com/symfony/symfony/security/advisories/GHSA-xx3c-qf5g-hc39 and release notes at https://github.com/symfony/symfony/releases/tag/v7.4.12 (and the matching 5.4.52 / 6.4.40 / 8.0.12 tags). If you cannot patch immediately, switch the SendmailTransport out of -t mode back to the default -bs mode (SMTP over stdin), which is not affected - the trade-off is that -bs behaves slightly differently in how recipients are derived from the message. As a second compensating control, validate and reject recipient addresses that begin with - before they reach the mailer (e.g. constrain user-supplied email inputs), accepting that this adds application-side input validation you must maintain. These controls reduce exposure but the upgrade is the definitive fix.

Affected VersionsENISA

symfony 6.0.0-BETA1, < 6.4.40

symfony < 5.4.52

mailer 6.0.0-BETA1, < 6.4.40

symfony 8.0.0-BETA1, < 8.0.12

symfony 7.0.0-BETA1, < 7.4.12

mailer 8.0.0-BETA1, < 8.0.12

mailer 7.0.0-BETA1, < 7.4.12

mailer < 5.4.52

Affected Packages

composer symfony/mailer fix: 5.4.52, 6.4.40, 7.4.12, 8.0.12

composer symfony/symfony fix: 5.4.52, 6.4.40, 7.4.12, 8.0.12

euvd mailer fix: 5.4.52

euvd mailer_6_0_0_beta1 fix: 6.4.40

euvd mailer_7_0_0_beta1 fix: 7.4.12

euvd mailer_8_0_0_beta1 fix: 8.0.12

euvd symfony fix: 5.4.52

euvd symfony_6_0_0_beta1 fix: 6.4.40

euvd symfony_7_0_0_beta1 fix: 7.4.12

euvd symfony_8_0_0_beta1 fix: 8.0.12

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 10 packages in composer, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is Symfony's Mailer, specifically the SendmailTransport class (pkg:composer/symfony_mailer, also shipped inside the monolithic pkg:composer/symfony_symfony). Symfony Mailer chooses a transport from the MAILER_DSN setting; the sendmail:// transport shells out to the local sendmail binary. Sendmail supports -bs (SMTP over stdin - Symfony's default and NOT vulnerable) and -t (recipients passed as command-line arguments). The root cause is CWE-88 (Argument Injection / improper neutralization of argument delimiters): in -t mode the recipient addresses were appended to the command line without a -- end-of-options separator. Because Symfony\Component\Mime\Address accepts addresses that begin with -, such a value is parsed by sendmail as an option (e.g. -C, -X, -O) rather than as a destination. The commit diff (c45144862dc289d03952f41f6078174089a3afc6) confirms the fix simply appends ' --' before the recipient list.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/symfony/symfony) PRIMARY 8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

vuln.today AI 5.9 MEDIUM

AC:H because exploitation needs the non-default sendmail '-t' mode plus an app path passing attacker input as a recipient; PR:N/UI:N per the injection reaching sendmail directly; integrity-only impact (I:H, C:N, A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/symfony/symfony).

CVSS VectorVendor: https://github.com/symfony/symfony

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

High

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 20:36 vuln.today

v2 - CVSS changed

CVSS changed

Jul 14, 2026 - 20:22 NVD

8.7 (HIGH)

DescriptionCVE.org

Description

Symfony Mailer selects a transport via the MAILER_DSN environment variable / configuration (e.g. smtp://..., sendmail://..., native://default). SendmailTransport invokes the local sendmail binary and supports two modes: -bs (speak SMTP over stdin: the default) and -t (read the message on stdin, pass recipients as command-line arguments).

In -t mode, recipient addresses are appended to the sendmail command line without a -- end-of-options separator. A recipient address beginning with - (which Symfony\Component\Mime\Address accepts as valid) is therefore interpreted by sendmail as a command-line option rather than an address.

Resolution

The SendmailTransport transport now ensure -- is set before the list of recipients.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Executive ViewAI

Why It Matters

Symfony Mailer's SendmailTransport contains an argument injection vulnerability (CVE-2026-45068) that allows attackers controlling recipient addresses to inject sendmail command-line flags, potentially compromising email delivery integrity. This affects organizations using unpatched versions before 5.4.52, 6.4.40, 7.4.12, or 8.0.12, creating risk to critical email infrastructure, though no public exploit has been identified.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 80% exploitable

Prevalence

High

Symfony is a widely deployed PHP framework; Mailer is a common component

Threat Intel

1 source

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS GHSA CIRCL

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.