CVE-2026-46626: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

🗓️ 01 Jan 1970 00:00:00Reported by OpenJS FoundationType

CVE-2026-46626 patch bypass lets web requests set APP_ENV and APP_DEBUG via parse_str argv mismatch.

Reporter	Title	Published	Views	Family All 60
AstraLinux	Astra Linux – Vulnerability in symfony	11 Feb 202507:35	–	astralinux
BDU FSTEC	The vulnerability of the Symfony software platform for developing and managing web applications arises from the lack of measures taken to neutralize special elements, allowing attackers to execute arbitrary code.	14 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the http-client component of the Symfony software development and web application management platform allows attackers to access confidential data.	3 Jul 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the validator component in the Symfony software development and web application management platform allows a hacker to access confidential data.	3 Jul 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the http-foundation component of the Symfony software development and web application management platform allows attackers to access confidential data.	3 Jul 202500:00	–	bdu_fstec
Circl	CVE-2024-50340	6 Nov 202421:10	–	circl
Circl	CVE-2026-46626	20 May 202611:02	–	circl
CNNVD	Symfony 注入漏洞	6 Nov 202400:00	–	cnnvd
CVE	CVE-2024-50340	6 Nov 202421:09	–	cve
CVE	CVE-2026-46626	1 Jan 197000:00	–	cve