CVE-2026-24739

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.51, 6.4.33, 7.3.11, 7.4.5, and 8.0.5, the Symfony Process component did not correctly treat some characters notably = as “special” when escaping arguments on Windows. When PHP i...

CVE-2026-24739

Summary: CVE-2026-24739 affects the Symfony Process component in Symfony PHP framework. Prior to fixes, unquoted arguments containing characters like “=” could be mis-handled when PHP runs under MSYS2-based environments (e.g., Git Bash) and Symfony spawns native Windows executables. This could co...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection by replacing cmd.exe or placing a fake one in the working directory, which will be executed by ExecutableFinder.php when preparing command arguments. Note: This vulnerability only affects applications running on...

PT-2023-33016 · Symfony · Symfony/Process

Name of the Vulnerable Software and Affected Versions: symfony/process affected versions not specified Description: A malicious Composer package called symfont/process was discovered, which is a typosquat targeting users of symfony/process. The package has been removed from Packagist...

FreePBX 13.0.x 13.0.154 - Remote Command Execution

FreePBX 13.0.x 13.0.154 - Remote Command Execution Vulnerable software : Freepbx Tested versions : 13.0.x $this-commandline = $commandline; $this-cwd = $cwd; Line 275 $commandline = $this-commandline; if '\' === DIRECTORYSEPARATOR && $this-enhanceWindowsCompatibility $commandline = 'cmd /V:ON...