Junglewise Threat Intelligence

CVE-2026-47767: Symfony Runtime environment variable manipulation via query string bypass

CVE-2026-47767 · Severity: medium · CVSS 6.9 · Published 2026-07-14

Vendors: Symfony.

Executive brief

Symfony is a popular PHP framework used to build web applications. A vulnerability in its runtime component allows an attacker to manipulate application settings, such as enabling debug mode or changing the environment configuration, via a specially crafted web request. This could lead to the exposure of sensitive system information or unauthorized changes to how the application behaves.

Technical details

This vulnerability is a bypass of the fix for CVE-2024-50340. The original fix attempted to gate runtime 'argv' parsing by checking if the $_GET superglobal was empty. However, a discrepancy between how parse_str() and the web SAPI handle query strings allows an attacker to craft a request where $_GET remains empty while $_SERVER['argv'] still contains attacker-controlled flags. By injecting flags such as --env or --no-debug, an attacker can override critical application configurations (APP_ENV or APP_DEBUG). This is classified as an interpretation conflict (CWE-436). The issue is resolved by gating 'argv' parsing on $_SERVER['QUERY_STRING'] instead of $_GET.

Affected products

  • Symfony symfony/symfony >= 5.4.46, < 5.4.52; >= 6.4.14, < 6.4.40; >= 7.1.7, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
  • Symfony symfony/runtime >= 5.4.46, < 5.4.52; >= 6.4.14, < 6.4.40; >= 7.1.7, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12

Timeline

  • 2026-07-14: disclosed
  • 2026-07-14: advisory
  • 2026-05-20: patched: Release date of fixed versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

References