#VU122102 Improper neutralization of argument delimiters in a command in Symfony - CVE-2026-24739
Published: January 28, 2026
Vulnerability identifier: #VU122102
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-24739
CWE-ID: CWE-88
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Symfony
Symfony
Software vendor:
SensioLabs
SensioLabs
Description
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper input validation when executing PHP from a MSYS2-based environment (e.g. Git Bash). If an application (or tooling such as Composer scripts) uses Symfony Process to invoke file-management commands (e.g. rmdir, del, etc.) with a path argument containing =, the MSYS2 conversion layer may alter the argument at runtime. A remote attacker can trick the victim into passing specially crafted input to the application and execute dangerous commands on the system.
The vulnerability affects Windows installations only.
Remediation
Install updates from vendor's website.