VYPR
← All advisories
High severity7.3OSV Advisory· Published Nov 6, 2024· Updated Apr 15, 2026

CVE-2024-50340

CVE-2024-50340

Description

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the register_argv_argc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the SymfonyRuntime now ignores the argv values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
symfony/runtimePackagist
>= 5.3.0, < 5.4.465.4.46
symfony/runtimePackagist
>= 6.0.0, < 6.4.146.4.14
symfony/runtimePackagist
>= 7.0.0, < 7.1.77.1.7
symfony/symfonyPackagist
>= 5.3.0, < 5.4.465.4.46
symfony/symfonyPackagist
>= 6.0.0, < 6.4.146.4.14
symfony/symfonyPackagist
>= 7.0.0, < 7.1.77.1.7

Affected products

1

Patches

4
057d88bef2d1
https://github.com/symfony/symfonyvia osv
commit
d1797e5b5b54
https://github.com/symfony/symfonyvia osv
commit
5001143568bc
https://github.com/symfony/symfonyvia osv
commit
a77b308c3f17

Do not read from argv on non-CLI SAPIs

https://github.com/symfony/symfonyWouter de JongOct 15, 2024via ghsa
commit
4 files changed · +29 −5
  • src/Symfony/Component/Runtime/SymfonyRuntime.php+5 −1 modified
    @@ -95,7 +95,7 @@ public function __construct(array $options = [])
 
         if (isset($options['env'])) {
             $_SERVER[$envKey] = $options['env'];
-        } elseif (isset($_SERVER['argv']) && class_exists(ArgvInput::class)) {
+        } elseif (empty($_GET) && isset($_SERVER['argv']) && class_exists(ArgvInput::class)) {
             $this->options = $options;
             $this->getInput();
         }
@@ -216,6 +216,10 @@ protected static function register(GenericRuntime $runtime): GenericRuntime
 
     private function getInput(): ArgvInput
     {
+        if (!empty($_GET) && filter_var(ini_get('register_argc_argv'), \FILTER_VALIDATE_BOOL)) {
+            throw new \Exception('CLI applications cannot be run safely on non-CLI SAPIs with register_argc_argv=On.');
+        }
+
         if (null !== $this->input) {
             return $this->input;
         }
  • src/Symfony/Component/Runtime/Tests/phpt/kernel.php+5 −3 modified
    @@ -17,19 +17,21 @@
 
 class TestKernel implements HttpKernelInterface
 {
+    private $env;
     private $var;
 
-    public function __construct(string $var)
+    public function __construct(string $env, string $var)
     {
+        $this->env = $env;
         $this->var = $var;
     }
 
     public function handle(Request $request, $type = self::MASTER_REQUEST, $catch = true): Response
     {
-        return new Response('OK Kernel '.$this->var);
+        return new Response('OK Kernel (env='.$this->env.') '.$this->var);
     }
 }
 
 return function (array $context) {
-    return new TestKernel($context['SOME_VAR']);
+    return new TestKernel($context['APP_ENV'], $context['SOME_VAR']);
 };
  • src/Symfony/Component/Runtime/Tests/phpt/kernel.phpt+1 −1 modified
    @@ -9,4 +9,4 @@ require $_SERVER['SCRIPT_FILENAME'] = __DIR__.'/kernel.php';
 
 ?>
 --EXPECTF--
-OK Kernel foo_bar
+OK Kernel (env=dev) foo_bar
  • src/Symfony/Component/Runtime/Tests/phpt/kernel_register_argc_argv.phpt+18 −0 added
    @@ -0,0 +1,18 @@
+--TEST--
+Test HttpKernelInterface with register_argc_argv=1
+--INI--
+display_errors=1
+register_argc_argv=1
+--FILE--
+<?php
+
+// emulating PHP behavior with register_argc_argv=1
+$_GET['-e_test'] = '';
+$_SERVER['argc'] = 1;
+$_SERVER['argv'] = [' ', '-e', 'test'];
+
+require $_SERVER['SCRIPT_FILENAME'] = __DIR__.'/kernel.php';
+
+?>
+--EXPECTF--
+OK Kernel (env=dev) foo_bar

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.