CVE-2026-47767: Symfony Information Disclosure Vulnerability

CVE-2026-47767 Overview

CVE-2026-47767 is a patch bypass vulnerability in the Symfony PHP framework runtime component. The flaw undermines the previous fix for CVE-2024-50340, which gated runtime argv parsing on empty($_GET). Because parse_str() and the web SAPI can disagree on how query strings are parsed, an attacker can craft a request that leaves $_GET empty while $_SERVER['argv'] still carries attacker-controlled --env or --no-debug flags. This allows remote manipulation of APP_ENV and APP_DEBUG values on affected Symfony deployments. The issue affects versions 5.4.46 through 5.4.51, 6.4.x through 6.4.39, 7.4.x through 7.4.11, and 8.0.x through 8.0.11.

Critical Impact
A remote, unauthenticated attacker can flip a production Symfony application into dev mode or enable debug output, exposing sensitive stack traces, environment variables, and internal application state.

Affected Products

Symfony 5.4.46 through 5.4.51
Symfony 6.4.x prior to 6.4.40
Symfony 7.4.x prior to 7.4.12
Symfony 8.0.x prior to 8.0.12

Discovery Timeline

2026-07-14 - CVE-2026-47767 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-47767

Vulnerability Analysis

The vulnerability resides in SymfonyRuntime.php, the bootstrap logic that determines whether the runtime should parse command-line arguments from $_SERVER['argv']. The original CVE-2024-50340 patch conditionally parsed argv only when $_GET was empty, on the assumption that an empty $_GET array reliably indicates a CLI invocation. Attackers can defeat this assumption by sending query strings that PHP's web SAPI accepts but parse_str() decomposes into no usable keys. The result is that $_GET appears empty while raw argv-style data survives in $_SERVER['argv']. The Symfony runtime then processes those values as legitimate command-line options and applies --env or --no-debug overrides to the application environment. This is classified as [CWE-436] Interpretation Conflict.

Root Cause

The root cause is inconsistent parsing between PHP's web SAPI query string handling and parse_str(). The guard empty($_GET) is not a reliable proxy for "this is a CLI request," allowing a web request to satisfy the gate while still delivering CLI-style arguments.

Attack Vector

An unauthenticated attacker sends an HTTP request with a crafted query string designed to leave $_GET empty while injecting --env=dev or --no-debug values into $_SERVER['argv']. The Symfony runtime picks up those flags and alters APP_ENV or APP_DEBUG for the request lifecycle.

php

         if (isset($options['env'])) {
             $_SERVER[$envKey] = $options['env'];
-        } elseif (empty($_GET) && isset($_SERVER['argv']) && class_exists(ArgvInput::class)) {
+        } elseif (!isset($_SERVER['QUERY_STRING']) && isset($_SERVER['argv']) && class_exists(ArgvInput::class)) {
             $this->options = $options;
             $this->getInput();
         }

Source: Symfony patch commit 3228c380. The fix replaces the empty($_GET) check with !isset($_SERVER['QUERY_STRING']), which reliably distinguishes CLI from web SAPI invocations.

Detection Methods for CVE-2026-47767

Indicators of Compromise

HTTP requests containing unusual query string patterns such as literal --env, --no-debug, or argv fragments
Application logs showing unexpected transitions between prod and dev for APP_ENV during web request handling
Symfony debug toolbars, profiler pages, or verbose stack traces served from production hostnames

Detection Strategies

Inspect web server access logs for query strings that decode to empty $_GET values but contain CLI-style tokens
Add runtime assertions in public/index.php that log or reject requests where $_SERVER['argv'] is populated during web SAPI execution
Correlate WAF telemetry for query strings containing --env=, --no-debug, or -e sequences with subsequent debug endpoint access

Monitoring Recommendations

Monitor for unexpected exposure of /_profiler or /_wdt routes on internet-facing Symfony deployments
Alert on any framework log entry indicating APP_DEBUG=1 while running in a production environment
Track Symfony component versions across your fleet and flag hosts still running vulnerable releases

How to Mitigate CVE-2026-47767

Immediate Actions Required

Upgrade Symfony to 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on your major version branch
Audit production applications for signs that APP_DEBUG was flipped on during request handling
Rotate credentials and secrets that may have been exposed via debug output or profiler pages

Patch Information

The fix is delivered in Symfony releases v5.4.52, v6.4.40, v7.4.12, and v8.0.12. See the GHSA-fqc7-9xjw-jrh3 advisory and the patch commit for details.

Workarounds

Force APP_ENV and APP_DEBUG explicitly in your web server or PHP-FPM configuration so runtime overrides cannot take effect
Unset $_SERVER['argv'] at the top of public/index.php before the Symfony runtime bootstraps
Deploy a WAF rule that blocks query strings containing --env, --no-debug, or argv-style option tokens

bash

# Force environment values in PHP-FPM pool configuration
env[APP_ENV] = prod
env[APP_DEBUG] = 0

# Or defensively unset argv at the top of public/index.php
# unset($_SERVER['argv']);