https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T14:01:57.430529+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-337905 EUVD-2026-337905 2026-10-06T14:01:57.433727+00:00 EUVD-2026-337905 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45068 fkie_cve-2026-45068 2026-10-06T14:01:57.433758+00:00

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mode appended recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address beginning with - to be interpreted as a sendmail command-line option instead of an address. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

 https://cve.radiocsirt.org/vuln/ghsa-xx3c-qf5g-hc39 GHSA-xx3c-qf5g-hc39 — Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address 2026-10-06T14:01:57.433789+00:00

Affected: Packagist: symfony/mailer, Packagist: symfony/symfony

### Description

Symfony Mailer selects a transport via the `MAILER_DSN` environment variable / configuration (e.g. `smtp://...`, `sendmail://...`, `native://default`). `SendmailTransport` invokes the local `sendmail` binary and supports two modes: `-bs` (speak SMTP over stdin: the default) and `-t` (read the message on stdin, pass recipients as command-line arguments).

In `-t` mode, recipient addresses are appended to the sendmail command line **without a `--` end-of-options separator**. A recipient address beginning with `-` (which `Symfony\Component\Mime\Address` accepts as valid) is therefore interpreted by sendmail as a command-line option rather than an address.

### Resolution

The `SendmailTransport` transport now ensure `--` is set before the list of recipients.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/c45144862dc289d03952f41f6078174089a3afc6) for branch 5.4.

### Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45068 UBUNTU-CVE-2026-45068 2026-10-06T14:01:57.433837+00:00

Affected: Ubuntu:16.04:LTS: symfony, Ubuntu:Pro:18.04:LTS: symfony, Ubuntu:Pro:20.04:LTS: symfony, Ubuntu:Pro:22.04:LTS: symfony, Ubuntu:Pro:24.04:LTS: symfony, Ubuntu:25.10: symfony, Ubuntu:26.04:LTS: symfony

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mode appended recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address beginning with - to be interpreted as a sendmail command-line option instead of an address. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.