PT-2026-51054 · Packagist · Symfony/Ux-Live-Component

Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-49215

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Symfony UX LiveComponent versions prior to 2.x Symfony UX LiveComponent versions prior to 3.x

Description Methods annotated with #[LiveAction] in symfony/ux-live-component are invokable from the browser to mutate server-side state via AJAX. The function isLiveComponentRequest() previously relied on the presence of the Accept: application/vnd.live-component+html header for CSRF protection. However, because the Accept header is a CORS-safelisted request header, it can be set via cross-origin fetch() without triggering a preflight request, allowing #[LiveAction] calls to be forged cross-origin against a victim's session. This risk is higher for applications using SameSite=None session cookies or permissive cookie policies.

Recommendations Update to the patched version of the 2.x branch. Update to the patched version of the 3.x branch.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-49215

GHSA-4M4J-HMQQ-3GXM

Affected Products

Symfony/Ux-Live-Component

References · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-live-component/CVE-2026-49215.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-4m4j-hmqq-3gxm · Vendor Advisory
• https://github.com/symfony/ux/security/advisories/GHSA-4m4j-hmqq-3gxm · Note
• https://github.com/symfony/ux · Note
• https://github.com/symfony/ux/commit/aed7493db2b4b7bf1f9c79b33cda544f06904b27 · Note
• https://twitter.com/dailycve/status/2068099300555444369 · Twitter Post