CVE-2024-51736
Command execution hijack on Windows with Process class in symfony/process
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Command execution hijack on Windows with Process class in symfony/process
| Assigner | GitHub_M |
| Reserved | 2024-10-31 |
| Published | 2024-11-06 |
| Updated | 2024-11-06 |
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
https://github.com/symfony/symfony/security/advisories/GHSA-qq5c-677p-737q
https://github.com/symfony/symfony/security/advisories/GHSA-qq5c-677p-737q
