CVE-2026-47767 is an improper handling flaw in Symfony's runtime component, scored CVSS 9.8 (critical). A crafted query string can change APP_ENV or APP_DEBUG on affected web setups. Symfony fixed it in 5.4.52, 6.4.40, 7.4.12 and 8.0.12, so update symfony/runtime or symfony/symfony to one of those.
What's affected
The GitHub advisory lists symfony/runtime and symfony/symfony as affected in these ranges:
- 5.4.46 up to but not including 5.4.52
- 6.4.14 up to but not including 6.4.40
- 7.1.7 up to but not including 7.4.12
- 8.0.0 up to but not including 8.0.12
Patched versions are 5.4.52, 6.4.40, 7.4.12 and 8.0.12.
The advisory lists these preconditions: the application runs under a web SAPI, the PHP setting register_argc_argv is On, and the application boots through symfony/runtime. No authentication is needed. An unauthenticated GET request is enough to change the environment name and toggle debug mode.
This is a follow up to the earlier CVE-2024-50340. The first fix gated argument parsing on whether the GET array was empty, and the new advisory says that check is unreliable.
How to check if you're exposed
Check the installed version of the runtime component and the full framework package.
composer show symfony/runtime
composer show symfony/symfony
composer why symfony/runtime
Compare the version with the ranges above. Many applications install individual symfony components rather than the full package, so the runtime check matters most.
Then check the PHP setting. In a web request context, phpinfo() or your hosting panel shows the value of register_argc_argv. The command line php -i can report a different value from the web SAPI, so do not rely on it alone.
If the setting is Off for your web SAPI, one precondition in the advisory does not hold. Still upgrade, since configuration can change.
What to do now
- Run composer show on symfony/runtime and symfony/symfony in each application.
- Update to 5.4.52, 6.4.40, 7.4.12 or 8.0.12, depending on your line, with composer update.
- Deploy, then clear the application cache so the new code is in use.
- Check register_argc_argv for your web SAPI and turn it Off if nothing needs it.
- Confirm production runs with debug off by checking APP_ENV and APP_DEBUG after the update.
Why it matters
The record maps this to CWE-436, interpretation conflict. Two parts of the system read the same request and reached different conclusions. According to the advisory, parse_str builds the GET array one way while the web SAPI builds argv from the raw query another way, so a query can leave the GET array empty while argv still carries command line style flags.
The effect is that a visitor can influence settings the developer meant to control, such as the environment name and whether debug mode is on. Debug mode in a production site can reveal internals that make further attacks easier. The advisory frames the fix as using one source of truth, the query string itself, for both the check and the input it protects. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2026-47767 exploited in the wild?
The record's KEV flag is false, and the pages I read do not say it is exploited. Treat it as a patch item and keep an eye on the advisory for changes.
Am I safe if register_argc_argv is Off?
One of the advisory's stated preconditions would not hold, which lowers your exposure. The advisory still recommends upgrading, and settings can change later.
Sources
Last reviewed: 19 October 2026.
