Detections
Analytics

SCA: security update for symfony/process, symfony/symfony (GHSA-r39x-jcww-82v6)

medium Tenable Self-Hosted Container Security Plugin ID 437362

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to
 versions 5.4.51, 6.4.33, 7.3.11, 7.4.5, and 8.0.5, the Symfony Process component did not correctly treat
 some characters (notably `=`) as “special” when escaping arguments on Windows. When PHP is executed from
 an MSYS2-based environment (e.g. Git Bash) and Symfony Process spawns native Windows executables, MSYS2’s
 argument/path conversion can mis-handle unquoted arguments containing these characters. This can cause the
 spawned process to receive corrupted/truncated arguments compared to what Symfony intended. If an
 application (or tooling such as Composer scripts) uses Symfony Process to invoke file-management commands
 (e.g. `rmdir`, `del`, etc.) with a path argument containing `=`, the MSYS2 conversion layer may alter the
 argument at runtime. In affected setups this can result in operations being performed on an unintended
 path, up to and including deletion of the contents of a broader directory or drive. The issue is
 particularly relevant when untrusted input can influence process arguments (directly or indirectly, e.g.
 via repository paths, extracted archive paths, temporary directories, or user-controlled configuration).
 Versions 5.4.51, 6.4.33, 7.3.11, 7.4.5, and 8.0.5 contains a patch for the issue. Some workarounds are
 available. Avoid running PHP/one's own tooling from MSYS2-based shells on Windows; prefer cmd.exe or
 PowerShell for workflows that spawn native executables. Avoid passing paths containing `=` (and similar
 MSYS2-sensitive characters) to Symfony Process when operating under Git Bash/MSYS2. Where applicable,
 configure MSYS2 to disable or restrict argument conversion (e.g. via `MSYS2_ARG_CONV_EXCL`), understanding
 this may affect other tooling behavior. (CVE-2026-24739)

See Also

https://github.com/advisories/GHSA-r39x-jcww-82v6

Plugin Details

Severity: Medium

ID: 437362

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/29/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.59

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.6

Temporal Score: 4.4

Vector: CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C

CVSS Score Source: CVE-2026-24739

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.7

Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/28/2026

Vulnerability Publication Date: 1/28/2026

Reference Information

CVE: CVE-2026-24739

cwe: CWE-88