PT-2026-44142 · Symfony · Symfony

CVE-2026-45073 · Published 2026-05-21 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4

Description The SymfonyComponentCacheAdapterPdoAdapter contains a flaw in the clear($prefix) method (inherited from AbstractAdapterTrait). In the non-versioning code path, the $prefix variable is concatenated into a namespace and passed to PdoAdapter::doClear(), which constructs a SQL query using a LIKE clause. Because the $namespace value is interpolated directly into the SQL text and executed via PDO::exec() without being bound, a user who can influence the $prefix variable can perform SQL injection. This allows an attacker to expand the deletion scope beyond the intended prefix to arbitrary rows or alter the query semantics.

Recommendations Update to version 5.4 or later. As a temporary workaround, restrict the use of the clear($prefix) method to ensure the $prefix variable does not contain characters outside the range [-+.A-Za-z0-9].

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-45073

GHSA-6QH9-H6WF-JGQC

Affected Products

Symfony

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45073.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2026-45073.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45073.yaml · Exploit
• https://github.com/symfony/symfony/security/advisories/GHSA-6qh9-h6wf-jgqc · Vendor Advisory
• https://github.com/symfony/symfony/commit/ec50b799d79ebe24561f29351c1efcb6da95c9b1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45073 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45073 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45073 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6qh9-h6wf-jgqc · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-45073 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45073 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45073 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45073 · Vendor Advisory
• https://github.com/symfony/symfony/releases/tag/v7.4.12 · Note
• https://github.com/symfony/symfony/releases/tag/v5.4.52 · Note