Prior to Symfony versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in –t mode appended recipient addresses to the sendmail command line without a ‘--’ end‑of‑options separator. Consequently, an address starting with a dash could be misinterpreted as a sendmail command‑line option rather than a recipient. This allows an application that accepts untrusted recipient addresses to inject sendmail options, potentially altering message delivery or mailer behavior. The flaw is classified as CWE‑88 and is addressed by applying the patch in the mentioned releases, which enforce the separator or sanitize such addresses.

Symfony Mailer and Symfony Framework versions up to 5.4.51, 6.4.39, 7.4.11, and 8.0.11 are vulnerable. The issue is resolved in Symfony 5.4.52, 6.4.40, 7.4.12, and 8.0.12 and later releases. Any installation of the affected products that still uses the legacy sendmail transport in –t mode is at risk.

The severity score of 8.7 marks this as a high‑risk flaw, but the EPSS score is below 1%, implying a low probability of real‑world exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation campaigns. Based on the description, it is inferred that the attacker must be able to supply recipient addresses containing leading dashes and that the application runs with privileges sufficient to invoke sendmail. The likely attack vector is an application that uses sendmail in –t mode and accepts unvalidated recipient addresses from user input. The flaw can be leveraged to manipulate sendmail options and potentially cause undesired mail delivery or system behavior.