SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

🗓️ 09 Jun 2026 21:58:11Reported by GitHub Advisory DatabaseType

SymfonyRuntime patch gates argv reading by QUERY_STRING to prevent APP_ENV and APP_DEBUG flips.

Reporter	Title	Published	Views	Family All 54
AstraLinux	Astra Linux - уязвимость в symfony	11 Feb 202507:35	–	astralinux
BDU FSTEC	The vulnerability of the Symfony software platform for developing and managing web applications arises from the lack of measures taken to neutralize special elements, allowing attackers to execute arbitrary code.	14 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the http-client component of the Symfony software development and web application management platform allows attackers to access confidential data.	3 Jul 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the validator component in the Symfony software development and web application management platform allows a hacker to access confidential data.	3 Jul 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the http-foundation component of the Symfony software development and web application management platform allows attackers to access confidential data.	3 Jul 202500:00	–	bdu_fstec
Circl	CVE-2024-50340	6 Nov 202421:10	–	circl
CNNVD	Symfony 注入漏洞	6 Nov 202400:00	–	cnnvd
CVE	CVE-2024-50340	6 Nov 202421:09	–	cve
CVE	CVE-2026-47767	9 Jun 202621:58	–	cve
Cvelist	CVE-2024-50340 Ability to change environment from query in symfony/runtime	6 Nov 202421:09	–	cvelist