Symfony · Symfony · CVE-2024-50340
**Name of the Vulnerable Software and Affected Versions**
Symfony versions prior to 5.4.46
Symfony versions prior to 6.4.14
Symfony versions prior to 7.1.7
**Description**
The issue exists due to the lack of measures to neutralize special elements, allowing a remote attacker to execute arbitrary code. When the `register argv argc` php directive is set to `on`, and users call any URL with a specially crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. Over 32,000 results are found to be potentially vulnerable.
**Recommendations**
For versions prior to 5.4.46, update to version 5.4.46 or later.
For versions prior to 6.4.14, update to version 6.4.14 or later.
For versions prior to 7.1.7, update to version 7.1.7 or later.
As a temporary workaround, consider setting the `register argv argc` php directive to `off` until a patch is applied.