Vulnerability advisory
CVE-2026-45073
Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
Also known as GHSA-6qh9-h6wf-jgqc
Severity
- CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/symfony/security-http ↗ | |
| All commits before 355f32f4318c962842f016eabd0966fde739f6fc | 355f32f4318c962842f016eabd0966fde739f6fc |
| 6530589fc40cdceda230fb6a69173ce52fa8b5ca to before 816860d96c4fb7ffd7708ae0531ea6e5a1190773 | 816860d96c4fb7ffd7708ae0531ea6e5a1190773 |
| f84d7d3c93e6a884908402775199b1f7d55c7be1 to before 1fc7ca636cbd2cad29b42cc13c9fd0c681c6efee | 1fc7ca636cbd2cad29b42cc13c9fd0c681c6efee |
| bea6dc79db4d95c34b77ec27273d812aa64d65be to before d776945b2dc41c0e609c56c1ef69863ab56856ed | d776945b2dc41c0e609c56c1ef69863ab56856ed |
| GIT github.com/symfony/symfony ↗ | |
| All commits before eabc5f9ed7831fe6de8d609c5ebc29aed1f8ef8f | eabc5f9ed7831fe6de8d609c5ebc29aed1f8ef8f |
| aa4e97099b5a67bdc9f2387fe8d099f5c712f81c to before 95a951788e30c45356278f4e4472cbbf552d0eb9 | 95a951788e30c45356278f4e4472cbbf552d0eb9 |
| d78c5f403d7ee794993660b1d5155536edd36fc1 to before 275f5cbccbcc50205206f05e599c4f57009aadb8 | 275f5cbccbcc50205206f05e599c4f57009aadb8 |
| 2e913a829cfbbf9cb38b321bdff1806b44b192eb to before 06d3b2c9a8aeb5d8493738cc51e24f6a1215827c | 06d3b2c9a8aeb5d8493738cc51e24f6a1215827c |
| Not specified | ec50b799d79ebe24561f29351c1efcb6da95c9b1 |
Also listed as affected (245)
| |
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion scope. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
References
- Webgithub.com/symfony/symfony/releases/tag/v5.4.52 ↗
- Webgithub.com/symfony/symfony/releases/tag/v6.4.40 ↗
- Webgithub.com/symfony/symfony/releases/tag/v7.4.12 ↗
- Webgithub.com/symfony/symfony/releases/tag/v8.0.12 ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45073.json ↗
- Advisorygithub.com/symfony/symfony/security/advisories/GHSA-6qh9-h6wf-jgqc ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-45073 ↗
- Fixgithub.com/symfony/symfony/commit/ec50b799d79ebe24561f29351c1efcb6da95c9b1 ↗