Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From version 5.4.46 up to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the patch for CVE‑2024‑50340 gated runtime argv parsing based on an empty $_GET value, but parse_str() and the web SAPI can disagree. A crafted query string can leave $_GET empty while $_SERVER["argv"] still carries attacker‑controlled --env or --no-debug flags that change APP_ENV or APP_DEBUG. This allows an attacker to force the application into a different environment or enable debugging without authentication. The issue is fixed in the mentioned versions, and the weakness is a parsing mismatch described by CWE‑436.

The vulnerability affects Symfony Runtime and core Symfony packages where the patch for CVE‑2024‑50340 was not applied. Specifically, versions 5.4.46 through 5.4.52, 6.4.40, 7.4.12, and 8.0.12 are impacted; the issue is intended to be resolved in those releases and later ones.

The CVSS score of 8.3 indicates high impact, and the EPSS score of less than 1 percent shows that exploitation is considered unlikely at present. The vulnerability is not listed in the CISA KEV catalog, and it can be exploited by sending a specially crafted HTTP GET request containing --env or --no-debug flags to a public‑facing Symfony application. No additional privileges or special conditions are required beyond the ability to issue a web request, making this a low‑barrier remote attack vector.