CVE-2026-45068: Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
Description
Symfony Mailer selects a transport via the MAILERDSN environment variable / configuration (e.g. smtp://..., sendmail://..., native://default). SendmailTransport invokes the local sendmail binary and supports two modes: -bs (speak SMTP over stdin: the default) and -t (read the message on stdin, pass recipients as command-line arguments).
In -t mode, recipient addresses are appended to the sendmail command line without a -- end-of-options separator. A recipient address beginning with - (which Symfony\Component\Mime\Address accepts as valid) is therefore interpreted by sendmail as a command-line option rather than an address.
Resolution
The SendmailTransport transport now ensure -- is set before the list of recipients.
The patch for this issue is available here for branch 5.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
Other sources
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mode appended recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address beginning with - to be interpreted as a sendmail command-line option instead of an address. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/mailerto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/mailerto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/mailerto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
composer/symfony/mailerto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
Symfony Mailer (SendmailTransport)to a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
Symfony Mailer (SendmailTransport)to a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
Symfony Mailer (SendmailTransport)to a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
Symfony Mailer (SendmailTransport)to a version that resolves this vulnerability.Fixed in 8.0.12 - Configuration
After upgrading, ensure SendmailTransport invokes sendmail with `--` set before appending the recipient addresses to the sendmail command line when running in `-t` mode, so dash-prefixed recipient addresses are not interpreted as sendmail command-line options.
Symfony Mailer (SendmailTransport) sendmail command-line recipients delimiter = -- (end-of-options separator) inserted before recipient list in -t mode
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45068?
CVE-2026-45068 has a risk severity score of 37.
What impact does CVE-2026-45068 have on Symfony Mailer?
CVE-2026-45068 affects the transport selection in Symfony Mailer when using the `MAILER_DSN` variable.
How can I mitigate CVE-2026-45068?
To mitigate CVE-2026-45068, ensure you are using a patched version of the Symfony Mailer package.
Which versions of Symfony Mailer are affected by CVE-2026-45068?
CVE-2026-45068 affects versions prior to the security fix for the Symfony Mailer component.
How do I update Symfony Mailer to address CVE-2026-45068?
You can update Symfony Mailer using Composer with the command `composer update symfony/mailer`.