Unknown · Symphony Php Framework · CVE-2024-51736
**Name of the Vulnerable Software and Affected Versions**
Symphony PHP framework versions prior to 5.4.46
Symphony PHP framework versions prior to 6.4.14
Symphony PHP framework versions prior to 7.1.7
**Description**
The Symphony process module in the Symphony PHP framework executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory, it will be called by the `Process` class when preparing command arguments, leading to possible hijacking.
**Recommendations**
For versions prior to 5.4.46, upgrade to version 5.4.46 or later.
For versions prior to 6.4.14, upgrade to version 6.4.14 or later.
For versions prior to 7.1.7, upgrade to version 7.1.7 or later.
As a temporary workaround, consider using the absolute path to `cmd.exe` when preparing command arguments with the `Process` class.