Arbitrary Argument Injection Affecting symfony/runtime package, versions >=5.4.46, <5.4.52>=6.4.14, <6.4.40>=7.1.7, <7.4.12>=8.0.0-BETA1, <8.0.12
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-SYMFONYRUNTIME-16873891
- published24 May 2026
- disclosed20 May 2026
- credit0xEr3n
Introduced: 20 May 2026
CVE-2026-46626 (opens in a new tab)How to fix?
Upgrade symfony/runtime to version 5.4.52, 6.4.40, 7.4.12, 8.0.12 or higher.
Overview
symfony/runtime is an Enables decoupling PHP applications from global state
Affected versions of this package are vulnerable to Arbitrary Argument Injection via SymfonyRuntime::getInput() when register_argc_argv=On in web SAPIs. An attacker can modify the Symfony application environment and debug settings by supplying a crafted query string that leaves $_GET empty while populating $_SERVER['argv'] with attacker-controlled flags such as --env and --no-debug.
Note: This vulnerability bypasses the protections added for CVE-2024-50340.