CVE-2026-47767 – Unauthenticated Environment Manipulation & Debug Disclosure – Symfony Runtime 5….

Summary

CVE-2026-47767 is a high-severity patch-bypass vulnerability in the Symfony Runtime component (symfony/runtime) affecting Symfony versions 5.4.46 through 8.0.11. It bypasses the earlier fix for CVE-2024-50340 by exploiting an interpretation conflict between PHP’s parse_str() function and the web SAPI’s argv population mechanism, allowing unauthenticated, network-based attackers to manipulate the APP_ENV and APP_DEBUG application settings via a crafted HTTP query string. With a CVSS 4.0 score of 8.3 (High), exploitation requires no authentication and no user interaction, and is made significantly more widespread by the fact that the precondition (register_argc_argv=On) is enabled by default in base PHP Docker images.

Technical details

• Root cause: The CVE-2024-50340 patch introduced a check using empty($_GET) to distinguish web requests from CLI invocations and block runtime argv parsing in web contexts. However, parse_str() (which populates $_GET) and the web SAPI (which populates $_SERVER['argv'] from the raw query string) do not process all inputs identically. An attacker can craft a query string that parse_str() evaluates as empty — leaving $_GET empty — while the SAPI still propagates the raw query string into $_SERVER['argv'], carrying attacker-controlled --env or --no-debug flags.
• Trigger conditions: The PHP directive register_argc_argv must be set to On (the default in official PHP Docker images), and the application must be booted through symfony/runtime under a web SAPI (Apache, Nginx/FPM, etc.).
• Attack vector: A single unauthenticated HTTP GET request with a specially crafted query string. No credentials or prior access required.
• Impact: An attacker can switch APP_ENV (e.g., to dev) and enable APP_DEBUG, which activates the Symfony debug profiler. The profiler can expose environment variables (including database credentials and API keys), application source code, stack traces, and internal service configurations. This constitutes a high-confidence confidentiality impact (VC:H) and may in certain configurations be escalated further via profiler abuse.
• Fix: SymfonyRuntime now checks isset($_SERVER['QUERY_STRING']) instead of empty($_GET), ensuring both the security gate and the protected argv-parsing code evaluate the same input source, eliminating the mismatch. Worker SAPIs (FrankenPHP, RoadRunner, Swoole) are unaffected because the runtime constructor executes once at boot time when QUERY_STRING is not yet set.
• Weakness type: CWE-436 – Interpretation Conflict (differing components handling the same input differently).

Affected software

• symfony/runtime and symfony/symfony:
  • 5.4.46 up to (not including) 5.4.52
  • 6.4.14 up to (not including) 6.4.40
  • 7.1.7 up to (not including) 7.4.12
  • 8.0.0 up to (not including) 8.0.12

Severity

• CVSS 4.0 base score: 8.3 (High)
• CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Mitigation and recommended actions

• Immediate – apply vendor patches: Upgrade to one of the following fixed releases:
  • symfony/runtime (or symfony/symfony) 5.4.52, 6.4.40, 7.4.12, or 8.0.12
• If immediate patching is not feasible – workaround: Disable the register_argc_argv PHP directive by setting register_argc_argv = Off in php.ini. Note that this setting is already Off by default on Debian-based distributions and Platform.sh, but is On in the official PHP Docker image, meaning containerised deployments are at elevated risk.
• Additional hardening: Restrict or block network access to /_profiler URLs on any production-facing Symfony deployment regardless of patching status.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-47767 at NIST
• Symfony GitHub Security Advisory (GHSA-fqc7-9xjw-jrh3)
• Symfony Official Blog Advisory