Improper neutralization of argument delimiters in a command in Symfony - CVE-2026-24739
Published: January 28, 2026
Vulnerability identifier: #VU122102
CSH Severity: Medium
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-24739
CWE-ID: CWE-88
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper input validation when executing PHP from a MSYS2-based environment (e.g. Git Bash). If an application (or tooling such as Composer scripts) uses Symfony Process to invoke file-management commands (e.g. rmdir, del, etc.) with a path argument containing =, the MSYS2 conversion layer may alter the argument at runtime. A remote attacker can trick the victim into passing specially crafted input to the application and execute dangerous commands on the system.
The vulnerability affects Windows installations only.
Affected software
Symfony
How to mitigate CVE-2026-24739
Install updates from vendor's website.
Symfony - addressed in versions 5.4.51, 6.4.33, 7.3.11, 7.4.5, 8.0.5