SEPTEMBER 12, 2026
Live Feed
Back to database
Case File

CVE-2026-47767

CRITICAL · CVSS 9.8 EPSS 0.39% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-14 · Last synced 2026-08-13

CyberRota Analysis

AI-Generated

The vulnerability affects Symfony versions 5.4.46 to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, allowing attackers to manipulate the application environment by exploiting discrepancies between the parsed query string and server arguments. This can lead to unauthorized changes in application behavior, potentially exposing sensitive information or enabling further attacks. Organizations using these versions of Symfony should prioritize updating to the patched versions to mitigate the risk of exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-47767
Severity
CRITICAL
CVSS
9.8
EPSS
0.39%

Original NVD Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty($_GET), but parse_str() and the web SAPI can disagree, allowing a crafted query string to leave $_GET empty while $_SERVER['argv'] still carries attacker-controlled --env or --no-debug flags that change APP_ENV or APP_DEBUG. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Related CVEs

Other vulnerabilities affecting the same vendor(s)