VulnSocial

CVE-2026-47767General(sensiolabs / symfony)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch sensiolabs symfony systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty($_GET), but parse_str() and the web SAPI can disagree, allowing a crafted query string to leave $_GET empty while $_SERVER['argv'] still carries attacker-controlled --env or --no-debug flags that change APP_ENV or APP_DEBUG. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

sensiolabs CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-436

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • symfony

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-07-15); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
sensiolabs
Products
symfony

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-07-15: 1Mentions · 2026-07-18: 1Mentions · 2026-08-09: 1Patch / Workaround · 2026-07-18: 1Patch / Workaround · 2026-08-09: 1Technical Details · 2026-07-18: 1Technical Details · 2026-08-09: 107-1507-1808-09
Signal classification3 categories
General
133.3%
Patch
133.3%
Disclosure
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-151
General1
2026-07-181
Patch1
2026-08-091
Disclosure1
Full discourse3 posts
  • takenaka hiroya@Joe_Biden_ja
    Disclosure

    Symfony の CVE-2026-47767 を掲載しました。過去に当てた CVE-2024-50340 の修正自体が不十分で、$_GET が空のままクエリ文字列から APP_ENV と APP_DEBUG を上書きできます。5.4系は 5.4.46 以上が対象、つまり前回… https://cve.autoarticles.net/cve/CVE-2026-47767

    Post summary

    The author discloses CVE‑2026‑47767 against Symfony 5.4 series, noting a flaw that allows overriding environment and debug settings via an empty $_GET, and cites affected version ranges with a link for more detail.

    0000077
    562 followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 CRITICAL: CVE-2026-47767 (CVSS 9.8) Symfony PHP framework bypass allows attackers to manipulate APP_ENV/APP_DEBUG via crafted query strings in versions 5.4.46-8.0.11. Patch NOW to 5.4.52, 6.4.40, 7.4.12, or 8.0.12. #CVE #Vulnerability #PatchNow https://t.co/Hb8ajsfrVa

    Post summary

    The tweet announces a critical CVE‑2026‑47767 affecting Symfony, details how the vulnerability allows manipulation of APP_ENV/APP_DEBUG via crafted query strings, and urges users to apply specific patched releases immediately.

    0000050
    82 followersView on X
  • DailyCVE@dailycve
    General

    🟠 Symfony Runtime, Interpretation Conflict, #CVE-2026-47767 (Medium) -DC-Jul2026-1007 https://dailycve.com/symfony-runtime-interpretation-conflict-cve-2026-47767-medium-dc-jul2026-1007/

    Post summary

    Only a CVE reference and rating are provided with no additional context about exploitation, PoC, patches, or technical details.

    0000042
    219 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appsensiolabssymfony---

Explore more

Back to dashboardsensiolabs CVEssymfony vulnerabilities