CVE-2026-24739
📋 TL;DR
This vulnerability in Symfony's Process component on Windows allows argument corruption when spawning native executables from MSYS2-based shells like Git Bash. It affects applications that use Symfony Process with user-controlled paths containing '=' characters, potentially leading to unintended file operations including data deletion. Systems running affected Symfony versions on Windows with MSYS2 environments are at risk.
💻 Affected Systems
- Symfony Process component
📦 What is this software?
Symfony by Sensiolabs
Symfony by Sensiolabs
Symfony by Sensiolabs
Symfony by Sensiolabs
Symfony by Sensiolabs
⚠️ Risk & Real-World Impact
Worst Case
Complete deletion of directory contents or drive data when file-management commands receive corrupted path arguments
Likely Case
File corruption or unintended file operations on specific paths containing '=' characters
If Mitigated
No impact if not using MSYS2 shells or if paths don't contain special characters
🎯 Exploit Status
Requires specific environment setup and ability to influence path arguments passed to Symfony Process
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.4.51, 6.4.33, 7.3.11, 7.4.5, or 8.0.5 depending on Symfony version
Vendor Advisory: https://github.com/symfony/symfony/security/advisories/GHSA-r39x-jcww-82v6
Restart Required: No
Instructions:
1. Identify your Symfony version. 2. Update to patched version via composer: 'composer update symfony/process'. 3. Verify update with 'composer show symfony/process'
🔧 Temporary Workarounds
Avoid MSYS2 shells
windowsRun PHP and tooling from cmd.exe or PowerShell instead of Git Bash/MSYS2
Configure MSYS2 argument conversion
windowsSet environment variable to exclude argument conversion for specific commands
set MSYS2_ARG_CONV_EXCL=*
Avoid special characters in paths
windowsEnsure paths passed to Symfony Process don't contain '=' or other MSYS2-sensitive characters
🧯 If You Can't Patch
- Switch to cmd.exe or PowerShell for all Symfony Process operations
- Implement input validation to reject paths containing '=' characters
🔍 How to Verify
Check if Vulnerable:
Check if running Symfony Process on Windows from Git Bash/MSYS2 with version below patched releasesCheck Version:
composer show symfony/process | grep versionsVerify Fix Applied:
Verify Symfony Process version is 5.4.51+, 6.4.33+, 7.3.11+, 7.4.5+, or 8.0.5+📡 Detection & Monitoring
Log Indicators:
- Unexpected file deletion logs
- Process execution errors with path arguments containing '='
SIEM Query:
Process execution where command contains 'rmdir', 'del', or similar with paths containing '=' characters on Windows systems🔗 References
- https://github.com/symfony/symfony/commit/35203939050e5abd3caf2202113b00cab5d379b3
- https://github.com/symfony/symfony/commit/ec154f6f95f8c60f831998ec4d246a857e9d179b
- https://github.com/symfony/symfony/issues/62921
- https://github.com/symfony/symfony/pull/63164
- https://github.com/symfony/symfony/security/advisories/GHSA-r39x-jcww-82v6
