Symfony’s Process component incorrectly escaped certain characters, particularly '=', when generating command-line arguments for native Windows executables in MSYS2‑based environments such as Git Bash. The mis‑escaping caused the spawned process to receive truncated or altered arguments, which could lead to the execution of file‑management commands like rmdir or del on unintended target paths. The outcome is the deletion of data from a broader directory or even an entire drive, representing a severe local destructive file operation.

The issue affects Symfony versions prior to 5.4.51, 6.4.33, 7.3.11, 7.4.5, and 8.0.5. Any application or tooling—such as Composer scripts—that relies on Symfony’s Process component to run Windows executables while operating in an MSYS2 or Git Bash shell on Windows is vulnerable. The affected component is included in the Symfony PHP framework, which is widely used for both web and console PHP applications.

The risk is primarily local; an attacker must be able to run PHP in an MSYS2‑based shell on the target Windows machine and influence the arguments passed to Symfony Process. Because the exploitation relies on untrusted input in a local context, organizations that run Symfony applications from MSYS2 shells or allow dynamic path construction should treat the vulnerability seriously and apply the recommended patches and workarounds promptly. The EPSS score of <1% indicates a very low exploitation probability in the wild, and the vulnerability is not listed in CISA’s KEV catalog.