CVE-2026-24739
2 advisories.
Packagist/symfony/process CVE-2026-24739: medium 6.3
Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows
Action: Upgrade symfony/process to 5.4.51 or later.
composer require symfony/process:5.4.51composer require symfony/process:6.4.33composer require symfony/process:7.3.11composer require symfony/process:7.4.5composer require symfony/process:8.0.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.4.51 | - |
| 6.4 | 6.4.33 | - |
| 7.3 | 7.3.11 | - |
| 7.4 | 7.4.5 | - |
| 8.0 | 8.0.5 | - |
Fixed versions
| 5.4.51 | 6.4.33 | 7.3.11 | 7.4.5 | 8.0.5 |
Sources
- osv: GHSA-r39x-jcww-82v6
- https://github.com/symfony/symfony/security/advisories/GHSA-r39x-jcww-82v6
- https://nvd.nist.gov/vuln/detail/CVE-2026-24739
- https://github.com/symfony/symfony/issues/62921
- https://github.com/symfony/symfony/pull/63164
- https://github.com/symfony/symfony/commit/35203939050e5abd3caf2202113b00cab5d379b3
- https://github.com/symfony/symfony/commit/ec154f6f95f8c60f831998ec4d246a857e9d179b
- https://github.com/symfony/symfony
CVE-2026-24739 · published · modified · JSON
Packagist/symfony/symfony CVE-2026-24739: medium 6.3
Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows
Action: Upgrade symfony/symfony to 5.4.51 or later.
composer require symfony/symfony:5.4.51composer require symfony/symfony:6.4.33composer require symfony/symfony:7.3.11composer require symfony/symfony:7.4.5composer require symfony/symfony:8.0.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.4.51 | - |
| 6.4 | 6.4.33 | - |
| 7.3 | 7.3.11 | - |
| 7.4 | 7.4.5 | - |
| 8.0 | 8.0.5 | - |
Fixed versions
| 5.4.51 | 6.4.33 | 7.3.11 | 7.4.5 | 8.0.5 |
Sources
- osv: GHSA-r39x-jcww-82v6#Packagist/symfony/symfony
- https://github.com/symfony/symfony/security/advisories/GHSA-r39x-jcww-82v6
- https://nvd.nist.gov/vuln/detail/CVE-2026-24739
- https://github.com/symfony/symfony/issues/62921
- https://github.com/symfony/symfony/pull/63164
- https://github.com/symfony/symfony/commit/35203939050e5abd3caf2202113b00cab5d379b3
- https://github.com/symfony/symfony/commit/ec154f6f95f8c60f831998ec4d246a857e9d179b
- https://github.com/symfony/symfony
CVE-2026-24739 · published · modified · JSON