Improper neutralization of argument delimiters in a command in Symfony - CVE-2026-24739

Detailed vulnerability description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper input validation when executing PHP from a MSYS2-based environment (e.g. Git Bash). If an application (or tooling such as Composer scripts) uses Symfony Process to invoke file-management commands (e.g. rmdir, del, etc.) with a path argument containing =, the MSYS2 conversion layer may alter the argument at runtime. A remote attacker can trick the victim into passing specially crafted input to the application and execute dangerous commands on the system.

The vulnerability affects Windows installations only.

How to mitigate CVE-2026-24739

Sources

• https://github.com/symfony/symfony/security/advisories/GHSA-r39x-jcww-82v6