AIKIDO-2026-10889
symfony/runtime is vulnerable to Interpretation Conflict
73
High Risk
This Affects:
symfony/runtimeTL;DR
SymfonyRuntime decides whether to read argv using a parser state that can disagree with the web SAPI query string. A crafted web request can leave $_GET empty while still feeding attacker-controlled flags through $_SERVER['argv']. Pre-fix applications can have environment or debug settings changed by an unauthenticated request when register_argc_argv is enabled. The fix gates argv handling on QUERY_STRING instead of parsed query parameters.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range
Background info
symfony/runtime is vulnerable to Interpretation Conflict in versions 5.4.46 - 5.4.51, 6.4.14 - 6.4.39, 7.1.7 - 7.4.11 and 8.0.0 - 8.0.11.
How to fix this
Upgrade the symfony/runtime and/or symfony/symfony library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant