CVE-2026-24739: 
PHP vulnerability analysis and mitigation

CVE-2026-24739 is an argument injection vulnerability in the Symfony Process component that can lead to destructive file operations on Windows when PHP is executed from an MSYS2-based environment such as Git Bash. The flaw affects Symfony versions prior to 5.4.51, 6.4.0–6.4.32, 7.3.0–7.3.10, 7.4.0–7.4.4, and 8.0.0–8.0.4. It was discovered by Seldaek, reported on January 2, 2026, and publicly disclosed on January 28, 2026. The vulnerability carries a CVSS v3.1 base score of 6.3 (Moderate) (GitHub Advisory, Symfony Advisory).

The root cause is improper neutralization of argument delimiters (CWE-88) in the escapeArgument() method of src/Symfony/Component/Process/Process.php. The method's regex pattern /[()%!^"<>&|\s]/ did not include = and other MSYS2-sensitive characters ([, ], ;, *, ?, ', $) in its set of special characters requiring quoting, causing arguments containing these characters to be returned unquoted. When Symfony Process constructs a command string such as rmdir /S /Q E:/=projects/my_project_name and executes it under Git Bash, MSYS2's automatic path conversion layer intercepts the unquoted argument and treats = as an argument separator, corrupting the path to something like E:/ — causing the command to operate on an unintended, much broader path. The fix (PR #63164) updates the regex to /[()%!^"<>&|\s[\]=;*?'$]/ to ensure these characters trigger proper quoting (Symfony Advisory, Patch Commit, Issue #62921).

The primary impact is high integrity and availability loss with no confidentiality impact. When exploited, file-management commands such as rmdir /S /Q can be redirected by MSYS2's path conversion to operate on an unintended directory root (e.g., an entire drive partition), potentially causing mass deletion of files and directories. The risk is especially severe when untrusted input influences process arguments — for example, via user-controlled repository paths, extracted archive paths, temporary directories, or Composer scripts — as this could result in complete data loss on the affected Windows system (GitHub Advisory, Issue #62921).

No public proof-of-concept exploit code exists and no in-the-wild exploitation has been observed as of the time of disclosure (GitHub Advisory). The vulnerability requires a local attack vector, high attack complexity, and user interaction, limiting its exploitability. The EPSS score is approximately 0.007% (2nd percentile), reflecting a low probability of near-term exploitation. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The issue was originally surfaced through a related Composer bug report (composer/composer#11568) and is referenced in the Symfony GitHub issue tracker (Issue #62921).

1. Identify a vulnerable environment: Confirm the target is running PHP from an MSYS2-based shell (e.g., Git Bash) on Windows, using a Symfony version prior to 5.4.51, 6.4.33, 7.3.11, 7.4.5, or 8.0.5.
2. Influence a process argument: Supply or manipulate a path argument containing = that will be passed to Symfony Process — for example, via a repository path, extracted archive path, temporary directory name, or user-controlled configuration value (e.g., E:/=projects/my_project_name).
3. Trigger a file-management operation: Cause the application or tooling (e.g., a Composer script) to invoke a Symfony Process command such as rmdir /S /Q or del with the crafted path argument.
4. MSYS2 path corruption occurs: Because the = character is not quoted by Symfony's escapeArgument(), MSYS2's automatic path conversion splits the argument at =, corrupting E:/=projects/my_project_name to E:/.
5. Unintended destructive operation: The native Windows executable (rmdir) receives the corrupted path and recursively deletes the contents of the broader directory or drive root, far beyond the intended target (Issue #62921, Symfony Advisory).

• File System: Unexpected mass deletion of files and directories, particularly from a drive root or broad directory tree; presence of paths containing = in recently executed command histories.
• Logs: Application or Composer logs showing rmdir, del, or similar file-management commands executed with paths that were truncated or altered (e.g., E:/ instead of E:/=projects/...); PHP error logs referencing Symfony Process execution failures.
• Process: Unusual invocations of rmdir.exe or cmd.exe with /S /Q flags and short/root-level path arguments spawned from a PHP or Composer parent process running under Git Bash.
• Environment: Evidence of MSYS2/Git Bash shell usage (e.g., presence of MSYS2 environment variables such as MSYS, MSYSTEM, or MINGW_PREFIX) in the process environment at the time of the incident (Issue #62921).

Upgrade Symfony to patched versions 5.4.51, 6.4.33, 7.3.11, 7.4.5, or 8.0.5, which update the escapeArgument() regex to properly quote MSYS2-sensitive characters including = (Symfony Advisory, Patch Commit). If immediate upgrade is not possible, apply these workarounds: (1) avoid running PHP or tooling from MSYS2-based shells on Windows — prefer cmd.exe or PowerShell when spawning native executables; (2) avoid passing paths containing = or other MSYS2-sensitive characters to Symfony Process under Git Bash/MSYS2; (3) configure MSYS2 to disable argument conversion using the MSYS2_ARG_CONV_EXCL environment variable, noting this may affect other tooling; (4) validate and sanitize any user-controlled input that may influence process arguments.

The vulnerability was published by Symfony core contributor nicolas-grekas and credited to reporter Seldaek, who originally surfaced the issue through a related Composer bug report. The Symfony project published a dedicated blog post and security advisory on January 28, 2026 (Symfony Blog). Community discussion appeared on Reddit's r/symfony and the Piefed social platform, reflecting moderate developer interest given the potential for catastrophic data loss in affected developer workflows. IBM subsequently issued advisories noting the impact on IBM API Connect (IBM Advisory).