Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

Summary

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty($_GET), but parse_str() and the web SAPI can disagree, allowing a crafted query string to leave $_GET empty while $_SERVER['argv'] still carries attacker-controlled --env or --no-debug flags that change APP_ENV or APP_DEBUG. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Timeline

1. Jul 14, 2026, 6:38 PM UTCCVE published
2. Jul 16, 2026, 2:33 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Jul 16, 2026, 2:34 PM UTCRecord last updated

Affected versions

• symfony symfony

  From 5.4.46 · fixed in 5.4.52; From 6.4.14 · fixed in 6.4.40; From 7.1.7 · fixed in 7.4.12; From 8.0.0-BETA1 · fixed in 8.0.12

• symfony runtime

  From 5.4.46 · fixed in 5.4.52; From 6.4.14 · fixed in 6.4.40; From 7.1.7 · fixed in 7.4.12; From 8.0.0-BETA1 · fixed in 8.0.12

• symfony/runtimePackagist

  From 5.4.46 · fixed in 5.4.52

• symfony/runtimePackagist

  From 6.4.14 · fixed in 6.4.40

• symfony/runtimePackagist

  From 7.1.7 · fixed in 7.4.12

• symfony/runtimePackagist

  From 8.0.0 · fixed in 8.0.12

• symfony/symfonyPackagist

  From 5.4.46 · fixed in 5.4.52

• symfony/symfonyPackagist

  From 6.4.14 · fixed in 6.4.40

• symfony/symfonyPackagist

  From 7.1.7 · fixed in 7.4.12

• symfony/symfonyPackagist

  From 8.0.0 · fixed in 8.0.12

References 6