CVE-2026-47767: Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
Description
CVE-2024-50340 (GHSA-x8vp-gf4q-mw5j) addressed an issue where, with registerargcargv=On, a crafted query string let an unauthenticated GET change the kernel environment and debug flag by feeding --env/--no-debug through $SERVER['argv']. The fix shipped in symfony/runtime 5.4.46 / 6.4.14 / 7.1.7 gated the argv read on empty($GET) as a proxy for "is this a CLI invocation".
That proxy is unsafe: parsestr() (which builds $GET) and the web SAPI (which builds $SERVER['argv'] from the raw query when registerargcargv=On) do not agree on every input, so an attacker can craft a query that leaves $GET empty while $SERVER['argv'] carries the attacker's flags. SymfonyRuntime::getInput() then parses them, restoring the exact primitive CVE-2024-50340 was meant to prevent.
Preconditions and impact match the original CVE: web SAPI, registerargcargv=On, app booted through symfony/runtime; from an unauthenticated GET an attacker can flip APPENV and toggle APPDEBUG.
Resolution
SymfonyRuntime now gates the argv read on isset($SERVER['QUERYSTRING']) rather than on empty($GET). QUERYSTRING is the same input the SAPI uses to build argv, so the security check and the thing it protects no longer parse different sources. Worker SAPIs (FrankenPHP / RoadRunner / Swoole) keep working because the runtime constructor runs once at boot when QUERYSTRING is unset.
The patch for this issue is available here for branch 5.4.
Credits
SymfonyRuntime would like to thank 0xEr3n for reporting the issue and Nicolas Grekas for providing the fix.
Other sources
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty($GET), but parsestr() and the web SAPI can disagree, allowing a crafted query string to leave $GET empty while $SERVER['argv'] still carries attacker-controlled --env or --no-debug flags that change APPENV or APPDEBUG. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
composer/symfony/runtimeto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/runtimeto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/runtimeto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/runtimeto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
symfony/runtimeto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
symfony/runtimeto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
symfony/runtimeto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
symfony/runtimeto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
symfony/runtimeto a version that resolves this vulnerability.Patch CVE-2024-50340 (GHSA-x8vp-gf4q-mw5j) - Configuration
Update SymfonyRuntime so the runtime only reads/parses $_SERVER['argv'] when isset($_SERVER['QUERY_STRING']), not when empty($_GET), to prevent parse_str() vs web SAPI argv mismatch that can leave $_GET empty while $_SERVER['argv'] contains attacker-controlled --env/--no-debug affecting APP_ENV/APP_DEBUG.
SymfonyRuntime argv gating condition for reading $_SERVER['argv'] = gate on isset($_SERVER['QUERY_STRING']) (instead of empty($_GET)) - Compensating control
If upgrading cannot be completed immediately, mitigate by ensuring QUERY_STRING-related handling cannot cause argv injection effects (e.g., prevent unauthenticated access to routes that trigger SymfonyRuntime initialization with register_argc_argv=On), since the described mismatch requires web SAPI with register_argc_argv=On and symfony/runtime boot via symfony/runtime.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47767?
CVE-2026-47767 has a risk score of 52, indicating a moderate severity level.
How do I fix CVE-2026-47767?
To fix CVE-2026-47767, ensure that the updated version of symfony/runtime is applied to your project.
What software is affected by CVE-2026-47767?
CVE-2026-47767 affects the symfony/symfony and symfony/runtime packages.
What type of vulnerability is associated with CVE-2026-47767?
CVE-2026-47767 is classified under CWE-20, which pertains to Input Validation vulnerabilities.
What exploit does CVE-2026-47767 allow?
CVE-2026-47767 allows an unauthenticated GET request to manipulate the kernel environment and debug flags by using crafted query strings.