sensiolabs symfony Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Published September 10, 2026 CVE-2024-50340

A bug in Symfony's runtime component lets someone change which environment or debug mode a PHP web app uses just by adding a specially crafted query string to a URL. This only happens on servers where a specific PHP setting is turned.

Severity
HighCVSS 3.1 · 7.3 · github.com
Fix
Fixed in 5.4.46
Affected versions
before 5.4.46; 6.0.0 or newer, but before 6.4.14; 7.0.0 or newer, but before 7.1.7
Weakness
CWE-74Injection
Exploit likelihood
64% in 30 daysEPSS, higher than 99% of known flaws
Affects
Symfony
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: yes · Technical impact: partial
EU ID
EUVD-2024-3330ENISA vulnerability database

How it works

  • The flaw only applies when the PHP directive register_argc_argv is turned on for the web server, which makes PHP populate command-line-style argument data even for normal web requests.
  • Symfony's runtime component was reading that argument data and using it to decide the app's environment and debug mode.
  • An attacker sends a URL containing a specially crafted query string that mimics those command-line-style values.
  • The application then boots using the environment or debug mode the attacker specified instead of its intended one.
  • Debug mode is meant for developers and can expose more internal information than a production environment.
  • No other prerequisite beyond that specific PHP setting being enabled is documented.

What to do

Check your project's installed symfony/runtime version by running composer show symfony/runtime in the application directory. Compare the result against the fixed versions: 5.4.46, 6.4.14, and 7.1.7. Check your php.ini or server configuration for whether register_argc_argv is set, since the flaw only triggers in that configuration.

Update symfony/runtime to 5.4.46, 6.4.14, or 7.1.7 or later depending on which branch your app uses. Run composer update symfony/runtime to pull in the fixed release. Symfony's advisory states there are no known workarounds, so upgrading is the documented fix; consult the GitHub security advisory for further detail.

Technical details

SymfonyRuntime built its ArgvInput from $SERVER['argv'], which PHP populates from the query string on non-CLI SAPIs when register_argc_argv is enabled. That let a crafted query string override the APP_ENV or debug flag before a request reached the kernel. The fix makes SymfonyRuntime ignore argv on non-CLI SAPIs and throws an exception if register_argc_argv is enabled while $GET is populated. CVSS 3.1 score is 7.3 (network attack vector, low complexity, no privileges or user interaction required, limited confidentiality, integrity, and availability impact).

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact Low Some data can be read
  • Integrity impact Low Some data can be modified
  • Availability impact Low Reduced performance or interruptions
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Open in FIRST.org calculator

References

View Original Source