CVE-2026-45068: Sensiolabs Symfony Command Injection Flaw

CVE-2026-45068 Overview

CVE-2026-45068 is an argument injection vulnerability [CWE-88] in the Symfony PHP framework's Mailer component. The flaw resides in SendmailTransport when operating in -t mode. The transport appended recipient addresses to the sendmail command line without inserting a -- end-of-options separator. An attacker-controlled email address beginning with - could therefore be interpreted as a sendmail command-line option rather than a recipient. This allows manipulation of sendmail behavior through crafted recipient addresses. Symfony maintainers fixed the issue in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Critical Impact
Attackers can inject sendmail command-line options through malicious recipient addresses, potentially altering mail routing, writing to arbitrary files, or influencing message delivery behavior in applications that pass untrusted addresses to SendmailTransport.

Affected Products

Symfony versions prior to 5.4.52
Symfony versions prior to 6.4.40 and 7.4.12
Symfony versions prior to 8.0.12

Discovery Timeline

2026-07-14 - CVE-2026-45068 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45068

Vulnerability Analysis

The vulnerability affects src/Symfony/Component/Mailer/Transport/SendmailTransport.php. When Symfony's SendmailTransport runs in -t mode, it constructs a shell command that invokes the local sendmail binary and appends each recipient address as a positional argument. Although each recipient is escaped with escapeshellarg(), escaping only protects against shell metacharacter injection. It does not prevent sendmail from parsing an argument beginning with - as a command-line option.

Sendmail and compatible mail transfer agents (MTAs) accept numerous options that alter delivery behavior. Without an explicit end-of-options marker, an address such as -OQueueDirectory=/tmp/attacker is consumed by the MTA as a configuration directive. This confusion between data and options is the classic pattern described by [CWE-88: Argument Injection or Modification].

Root Cause

The root cause is missing use of the POSIX -- end-of-options separator when building the sendmail command line. Any recipient string starting with - is treated as an option. Applications that accept user-supplied email addresses and pass them to SendmailTransport inherit this weakness.

Attack Vector

Exploitation requires the application to accept an attacker-controlled recipient address and forward it to SendmailTransport in -t mode. The attack is network-reachable, requires no authentication, and no user interaction. Successful exploitation impacts integrity by allowing modification of sendmail invocation parameters.

php

// Security patch - src/Symfony/Component/Mailer/Transport/SendmailTransport.php
            $chunks = AbstractStream::replace("\n.", "\n..", $chunks);
        }

+        if ($recipients) {
+            $command .= ' --';
+        }
        foreach ($recipients as $recipient) {
            $command .= ' '.escapeshellarg($recipient->getEncodedAddress());
        }
// Source: https://github.com/symfony/symfony/commit/c45144862dc289d03952f41f6078174089a3afc6

The patch prepends -- before the recipient list, forcing sendmail to treat all subsequent tokens as positional arguments rather than options.

Detection Methods for CVE-2026-45068

Indicators of Compromise

Sendmail process invocations containing recipient arguments that begin with -O, -C, -X, or other sendmail options.
Unexpected files written to directories referenced by -OQueueDirectory or -X logging flags on hosts running PHP applications.
Web request logs showing email form submissions where the recipient or To field starts with a hyphen.

Detection Strategies

Inspect application logs for outbound mail attempts where recipient values fail RFC 5321 address validation but were still passed to the transport.
Perform Software Composition Analysis (SCA) on PHP projects to identify symfony/mailer versions below 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Instrument the PHP runtime or use audit logging to record every command line passed to proc_open() targeting sendmail, then alert on entries missing a -- separator.

Monitoring Recommendations

Monitor process creation telemetry for sendmail child processes spawned by php-fpm or apache with suspicious flag-like arguments.
Track file creation in world-writable directories by the mail user account, which may indicate abuse of sendmail file-writing options.
Correlate WAF or application logs of form submissions containing hyphen-prefixed email fields with subsequent MTA activity.

How to Mitigate CVE-2026-45068

Immediate Actions Required

Upgrade symfony/mailer and related Symfony components to 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on your release branch.
Audit all code paths that instantiate SendmailTransport and confirm whether recipients originate from untrusted input.
Add server-side validation that rejects email addresses beginning with - before they reach any mail transport.

Patch Information

Symfony released fixes in v5.4.52, v6.4.40, v7.4.12, and v8.0.12. The technical fix is documented in the upstream commit c451448 and the GitHub Security Advisory GHSA-xx3c-qf5g-hc39.

Workarounds

Switch temporarily from SendmailTransport to an SMTP-based transport such as EsmtpTransport, which does not construct a local command line.
Enforce a strict recipient allow-list or regular expression at the application layer that rejects any address beginning with -.
Configure the local MTA to run under a dedicated low-privilege account with no write access to sensitive directories.

bash

# Update Symfony Mailer via Composer to a patched release
composer require symfony/mailer:^7.4.12

# Verify the installed version
composer show symfony/mailer | grep versions