CVE-2024-51736
Command execution hijack on Windows with Process class in symfony/process
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named cmd.exe is located in the current working directory it will be called by the Process class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Command execution hijack on Windows with Process class in symfony/process
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named cmd.exe is located in the current working directory it will be called by the Process class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-51736- CVSS 3.1
- 0.0 None
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2024-3302
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named cmd.exe is located in the current working directory it will be called by the Process class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2024-3302- CVSS 3.1
- 0.0 None
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qq5c-677p-737q
Symfony vulnerable to command execution hijack on Windows with Process class
Description
On Windows, when an executable file named cmd.exe is located in the current working directory it will be called by the Process class when preparing command arguments, leading to possible hijacking.
Resolution
The Process class now uses the absolute path to cmd.exe.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Jordi Boggiano for reporting the issue and Nicolas Grekas for providing the fix.
- Record
GHSA-qq5c-677p-737q- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
NVD
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named cmd.exe is located in the current working directory it will be called by the Process class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-51736- CVSS 3.1
- 0.0 None
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSV
Command execution hijack on Windows with Process class in symfony/process
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named cmd.exe is located in the current working directory it will be called by the Process class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-51736- CVSS 3.1
- 0.0 None
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVGHSA-qq5c-677p-737q
Symfony vulnerable to command execution hijack on Windows with Process class
Description
On Windows, when an executable file named cmd.exe is located in the current working directory it will be called by the Process class when preparing command arguments, leading to possible hijacking.
Resolution
The Process class now uses the absolute path to cmd.exe.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Jordi Boggiano for reporting the issue and Nicolas Grekas for providing the fix.
- Record
GHSA-qq5c-677p-737q- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
Show 4 moreShow less
OSVCLSA-2025-1761785573 No score
TuxCare security update for symfony/process (1 CVE)
TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 5.4.45-p1+tuxcare.
- Record
CLSA-2025-1761785573- Updated
- 2026-11-02
OSVCLSA-2025-1761785574 No score
TuxCare security update for symfony/process (1 CVE)
TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 6.4.13-p1+tuxcare.
- Record
CLSA-2025-1761785574- Updated
- 2026-11-02
OSVCLSA-2026-1771894663 No score
TuxCare security update for symfony/process (2 CVEs)
TuxCare rebuilt symfony/process to address 2 CVEs. Fixed in 4.4.44-p1+tuxcare.
- Record
CLSA-2026-1771894663- Updated
- 2026-11-02
OSVCLSA-2026-1772498780 No score
TuxCare security update for symfony/process (2 CVEs)
TuxCare rebuilt symfony/process to address 2 CVEs. Fixed in 3.4.47-p1+tuxcare.
- Record
CLSA-2026-1772498780- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/processPackagist |
before 5.4.46 | 5.4.46 |
symfony/processPackagist |
6.0.0 up to 6.4.14 | 6.4.14 |
symfony/processPackagist |
7.0.0 up to 7.1.7 | 7.1.7 |
symfony/symfonyPackagist |
before 5.4.46 | 5.4.46 |
symfony/symfonyPackagist |
6.0.0 up to 6.4.14 | 6.4.14 |
symfony/symfonyPackagist |
7.0.0 up to 7.1.7 | 7.1.7 |
symfony/processTuxCare:Packagist |
v5.4.45 up to 5.4.45-p1+tuxcare | 5.4.45-p1+tuxcare |
symfony/processTuxCare:Packagist |
v6.4.13 up to 6.4.13-p1+tuxcare | 6.4.13-p1+tuxcare |
symfony/processTuxCare:Packagist From an advisory covering 2 CVEs |
v4.4.44 up to 4.4.44-p1+tuxcare | 4.4.44-p1+tuxcare |
symfony/processTuxCare:Packagist From an advisory covering 2 CVEs |
v3.4.47 up to 3.4.47-p1+tuxcare | 3.4.47-p1+tuxcare |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfony/processPackagist |
before 5.4.46, plus listed versions 2.0.42.0.52.0.62.0.7v2.0.10 Show 45 moreShow lessv2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11 |
5.4.46 |
symfony/processPackagist |
6.0.0 up to 6.4.14, plus listed versions v6.0.0v6.0.11v6.0.19v6.0.2v6.0.3 Show 38 moreShow lessv6.0.5v6.0.7v6.0.8v6.1.0v6.1.0-BETA1v6.1.0-RC1v6.1.11v6.1.3v6.2.0v6.2.0-BETA1v6.2.0-BETA3v6.2.0-RC1v6.2.10v6.2.11v6.2.13v6.2.5v6.2.7v6.2.8v6.3.0v6.3.0-BETA1v6.3.0-RC1v6.3.11v6.3.12v6.3.2v6.3.4v6.4.0v6.4.0-BETA1v6.4.0-BETA2v6.4.0-BETA3v6.4.0-RC1v6.4.0-RC2v6.4.12v6.4.13v6.4.2v6.4.3v6.4.4v6.4.7v6.4.8 |
6.4.14 |
symfony/processPackagist |
7.0.0 up to 7.1.7, plus listed versions v7.0.0v7.0.2v7.0.3v7.0.4v7.0.7 Show 8 moreShow lessv7.0.8v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.3v7.1.5v7.1.6 |
7.1.7 |
symfony/symfonyPackagist |
before 5.4.46, plus listed versions 2.0.42.0.52.0.62.0.7v2.0.10 Show 45 moreShow lessv2.0.11v2.0.12v2.0.13v2.0.14v2.0.15v2.0.16v2.0.17v2.0.18v2.0.19v2.0.20v2.0.21v2.0.22v2.0.23v2.0.24v2.0.25v2.0.9v2.1.0v2.1.0-BETA1v2.1.0-BETA2v2.1.0-BETA3v2.1.0-BETA4v2.1.0-RC1v2.1.0-RC2v2.1.1v2.1.10v2.1.11v2.1.12v2.1.13v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9v2.2.0v2.2.0-BETA1v2.2.0-BETA2v2.2.0-RC1v2.2.0-RC2v2.2.0-RC3v2.2.1v2.2.10v2.2.11 |
5.4.46 |
symfony/symfonyPackagist |
6.0.0 up to 6.4.14, plus listed versions v6.0.0v6.0.1v6.0.10v6.0.11v6.0.12 Show 45 moreShow lessv6.0.13v6.0.14v6.0.15v6.0.16v6.0.17v6.0.18v6.0.19v6.0.2v6.0.20v6.0.3v6.0.4v6.0.5v6.0.6v6.0.7v6.0.8v6.0.9v6.1.0v6.1.0-BETA1v6.1.0-BETA2v6.1.0-RC1v6.1.1v6.1.10v6.1.11v6.1.12v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.1.7v6.1.8v6.1.9v6.2.0v6.2.0-BETA1v6.2.0-BETA2v6.2.0-BETA3v6.2.0-RC1v6.2.0-RC2v6.2.1v6.2.10v6.2.11v6.2.12v6.2.13v6.2.14v6.2.2 |
6.4.14 |
symfony/symfonyPackagist |
7.0.0 up to 7.1.7, plus listed versions v7.0.0v7.0.1v7.0.10v7.0.2v7.0.3 Show 15 moreShow lessv7.0.4v7.0.5v7.0.6v7.0.7v7.0.8v7.0.9v7.1.0v7.1.0-BETA1v7.1.0-RC1v7.1.1v7.1.2v7.1.3v7.1.4v7.1.5v7.1.6 |
7.1.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-51736 is a none vulnerability (CVSS 0.0) in Sensiolabs Symfony, published November 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in symfony/process 5.4.46.
References
github.com/symfony/symfony/security/advisories/GHSA-qq5c-677p-737q
symfony.com/cve-2024-51736
nvd.nist.gov/vuln/detail/CVE-2024-51736
Left out here: 1,111 versions. The JSON record has them.