EUVD-2026-44349
GHSA-fqc7-9xjw-jrh3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote (AV:N/PR:N/UI:N) but AC:H due to required register_argc_argv=On and the crafted parse_str/SAPI mismatch; C:H from forced debug exposure, I:L from env/flag toggling, no availability impact.
Primary rating from Vendor (https://github.com/symfony/symfony).
CVSS VectorVendor: https://github.com/symfony/symfony
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
Description
CVE-2024-50340 (GHSA-x8vp-gf4q-mw5j) addressed an issue where, with register_argc_argv=On, a crafted query string let an unauthenticated GET change the kernel environment and debug flag by feeding --env/--no-debug through $_SERVER['argv']. The fix shipped in symfony/runtime 5.4.46 / 6.4.14 / 7.1.7 gated the argv read on empty($_GET) as a proxy for "is this a CLI invocation".
That proxy is unsafe: parse_str() (which builds $_GET) and the web SAPI (which builds $_SERVER['argv'] from the raw query when register_argc_argv=On) do not agree on every input, so an attacker can craft a query that leaves $_GET empty while $_SERVER['argv'] carries the attacker's flags. SymfonyRuntime::getInput() then parses them, restoring the exact primitive CVE-2024-50340 was meant to prevent.
Preconditions and impact match the original CVE: web SAPI, register_argc_argv=On, app booted through symfony/runtime; from an unauthenticated GET an attacker can flip APP_ENV and toggle APP_DEBUG.
Resolution
SymfonyRuntime now gates the argv read on isset($_SERVER['QUERY_STRING']) rather than on empty($_GET). QUERY_STRING is the same input the SAPI uses to build argv, so the security check and the thing it protects no longer parse different sources. Worker SAPIs (FrankenPHP / RoadRunner / Swoole) keep working because the runtime constructor runs once at boot when QUERY_STRING is unset.
The patch for this issue is available here for branch 5.4.
Credits
SymfonyRuntime would like to thank 0xEr3n for reporting the issue and Nicolas Grekas for providing the fix.
AnalysisAI
Environment and debug-mode tampering in symfony/runtime (5.4.46-5.4.51, 6.4.14-6.4.39, 7.1.7-7.4.11, 8.0.0-8.0.11) lets an unauthenticated remote attacker flip APP_ENV and toggle APP_DEBUG via a crafted GET query string, bypassing the fix for CVE-2024-50340. The prior patch gated the argv read on empty($_GET), but because parse_str() and the web SAPI parse the raw query differently, an attacker can craft input that leaves $_GET empty while $_SERVER['argv'] still carries --env/--no-debug flags. No public exploit is listed in KEV, though the vendor commit ships a working proof-of-concept test case; EPSS is low at 0.10%.
Technical ContextAI
The affected component is Symfony's Runtime bootstrap layer (symfony/runtime), which selects application input at boot. When PHP's register_argc_argv INI directive is On, the web SAPI populates $_SERVER['argv'] by tokenizing the raw QUERY_STRING, the same mechanism CLI uses. SymfonyRuntime::getInput() reads that argv and feeds it to Symfony's ArgvInput, allowing --env and --no-debug options to override the kernel environment and debug flag. The root cause is CWE-20 (Improper Input Validation): the CVE-2024-50340 fix used empty($_GET) as a proxy for 'this is a CLI invocation,' but $_GET is built by parse_str() while argv is built directly from the raw query, and the two do not agree on all inputs (e.g. a leading '=' token that parse_str drops but the SAPI keeps), so the guard and the sink parse different sources. The corrected patch instead gates on isset($_SERVER['QUERY_STRING']) - the exact input the SAPI uses to build argv - closing the mismatch while leaving worker SAPIs (FrankenPHP, RoadRunner, Swoole) unaffected because their runtime constructor runs at boot when QUERY_STRING is unset.
RemediationAI
Vendor-released patch: upgrade symfony/runtime to 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on your branch (composer require symfony/runtime and update the lock file). If immediate patching is not possible, the most direct compensating control is to set PHP's register_argc_argv=Off in php.ini or the pool configuration for web-facing PHP-FPM/Apache workers - this removes the $_SERVER['argv'] source the attack relies on and has no impact on typical web requests, though it will break any CLI-style scripts that read argv through that SAPI. Additionally, ensure APP_DEBUG is hard-pinned to false and APP_ENV to prod at the application level (e.g. via a compiled/immutable .env or environment variables that the kernel does not allow to be overridden), so that even a successful argv injection cannot enable debug output. References: advisory https://github.com/symfony/symfony/security/advisories/GHSA-fqc7-9xjw-jrh3 and fix commit https://github.com/symfony/symfony/commit/3228c3806ee511008bea19a95084d460b17e5d25; release notes at v5.4.52, v6.4.40, v7.4.12, and v8.0.12.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today