Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

symfony/runtime

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9PackagistPublished

    SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

    CVE-2026-47767 · GHSA-fqc7-9xjw-jrh3

    Affected
    • Packagist symfony/runtime >= 5.4.46, < 5.4.52; >= 6.4.14, < 6.4.40; >= 7.1.7, < 7.4.12; >= 8.0.0, < 8.0.12
    Fixed in
    8.0.127.4.126.4.405.4.52· Vendor fix available
    Issue
    CVE-2024-50340 (GHSA-x8vp-gf4q-mw5j) addressed an issue where, with registerargcargv=On, a crafted query string let an unauthenticated GET change the kernel environment and debug flag by feeding --env/--no-debug through $SERVER['argv']. The fix shipped in symfony/runtime 5.4.46 / 6.4.14 / 7.1.7 gated the argv read on empty($GET) as a proxy for "is this a CLI invocation". That proxy is unsafe: parsestr() (which builds $GET) and the web SAPI (which builds $SERVER['argv'] from the raw query when registerargcargv=On) do not agree on every input, so an attacker can craft a query that leaves $GET empty while $SERVER['argv'] carries the attacker's flags. SymfonyRuntime::getInput() then parses them, restoring the exact primitive CVE-2024-50340 was meant to prevent. Preconditions and impact match the original CVE: web SAPI, registerargcargv=On, app booted through symfony/runtime; from an unauthenticated GET an attacker can flip APPENV and toggle APPDEBUG. Resolution SymfonyRuntime…

    Recommended action: Upgrade to 8.0.12, 7.4.12, 6.4.40 or 5.4.52 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 6.9PackagistPublished

    Symfony allows changing the environment through a query

    CVE-2024-50340 · GHSA-x8vp-gf4q-mw5j

    Affected
    • Packagist symfony/runtime >= 5.3.0, < 5.4.46; >= 6.0.0, < 6.4.14; >= 7.0.0, < 7.1.7
    Fixed in
    5.4.466.4.147.1.7· Vendor fix available
    Issue
    When the registerargcargv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. Resolution The SymfonyRuntime now ignores the argv values for non-cli SAPIs PHP runtimes The patch for this issue is available here for branch 5.4. Credits We would like to thank Vladimir Dusheyko for reporting the issue and Wouter de Jong for providing the fix.

    Recommended action: Upgrade to 7.1.7, 6.4.14 or 5.4.46 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →