Packagist/symfony/runtime CVE-2026-47767: medium, EPSS 0.72%
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
Action: Upgrade symfony/runtime to 5.4.52 or later.
composer require symfony/runtime:5.4.52composer require symfony/runtime:6.4.40composer require symfony/runtime:7.4.12composer require symfony/runtime:8.0.12Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.4.46 | 5.4.52 | - |
| 6.4.14 | 6.4.40 | - |
| 7.1.7 | 7.4.12 | - |
| 8.0.0 | 8.0.12 | - |
Fixed versions
| 5.4.52 | 6.4.40 | 7.4.12 | 8.0.12 |
Sources
- osv: GHSA-fqc7-9xjw-jrh3
- https://github.com/symfony/symfony/security/advisories/GHSA-fqc7-9xjw-jrh3
- https://github.com/symfony/symfony
CVE-2026-47767 · published · modified · JSON