CVE-2024-51736

Description

### Description On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing command arguments, leading to possible hijacking. ### Resolution The `Process` class now uses the absolute path to `cmd.exe`. The patch for this issue is available [here](https://github.com/symfony/symfony/commit/18ecd03eda3917fdf901a48e72518f911c64a1c9) for branch 5.4. ### Credits We would like to thank Jordi Boggiano for reporting the issue and Nicolas Grekas for providing the fix.

How to fix CVE-2024-51736

To remediate CVE-2024-51736, upgrade the affected package to a fixed version below.

• —upgrade to 5.4.46 or later
• —upgrade to 5.4.46 or later

Is CVE-2024-51736 being exploited?

Low — EPSS is 0.8%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 5.4.46
• from 0, < 5.4.46

CVSS scores

References (7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-51736
• PATCHgithub.com/symfony/symfony
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/symfony/process/CVE-2024-51736.yaml
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-51736.yaml