CVE-2026-45073
published 2026-07-14CVE-2026-45073: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12…
PriorityP345high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EPSS
0.41%
33.5th percentile
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion scope. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cache | symfony | < 5.4.52 | 5.4.52 |
| cache | symfony | — | — |
| cache | symfony | — | — |
| cache | symfony | — | — |
| sensiolabs | symfony | < 5.4.52 | 5.4.52 |
| sensiolabs | symfony | >= 6.0.0 < 6.4.40 | 6.4.40 |
| sensiolabs | symfony | >= 7.0.0 < 7.4.12 | 7.4.12 |
| sensiolabs | symfony | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | cache | >= 0 < 5.4.52 | 5.4.52 |
| symfony | cache | >= 6.0.0 < 6.4.40 | 6.4.40 |
| symfony | cache | >= 7.0.0 < 7.4.12 | 7.4.12 |
| symfony | cache | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | symfony | < 5.4.52 | 5.4.52 |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | >= 0 < 5.4.52 | 5.4.52 |
| symfony | symfony | >= 6.0.0 < 6.4.40 | 6.4.40 |
| symfony | symfony | >= 7.0.0 < 7.4.12 | 7.4.12 |
| symfony | symfony | >= 8.0.0 < 8.0.12 | 8.0.12 |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Symfony PdoAdapter::doClear prefix sql injection
vuldb·2026-05-28
CVE-2026-45073 [CRITICAL] Symfony PdoAdapter::doClear prefix sql injection
A vulnerability, which was classified as critical, has been found in Symfony. Impacted is the function PdoAdapter::doClear. The manipulation of the argument prefix leads to sql injection.
This vulnerability is traded as CVE-2026-45073. It is possible to initiate the attack remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
ghsa·2026-05-27
CVE-2026-45073 [MEDIUM] CWE-89 Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
### Description
`Symfony\Component\Cache\Adapter\PdoAdapter` is the PDO-backed cache adapter. Its `clear($prefix)` method (inherited from `AbstractAdapterTrait`) is documented to delete cache items whose key starts with `$prefix`.
In the non-versioning code path, the caller-supplied `$prefix` is concatenated into `$namespace = $this->namespace.$prefix` and passed to `PdoAdapter::doClear()`, which builds:
```sql
DELETE FROM WHERE LIKE '%'
```
The value is interpolated directly into the SQL text and executed with `PDO::exec()`: `$namespace` is not bound. A caller able to influence `$prefix` can break out of the literal and inject SQL, expanding deletion scope from the intended prefix to arbitrary rows,
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/symfony/symfony/commit/ec50b799d79ebe24561f29351c1efcb6da95c9b1https://github.com/symfony/symfony/releases/tag/v5.4.52https://github.com/symfony/symfony/releases/tag/v6.4.40https://github.com/symfony/symfony/releases/tag/v7.4.12https://github.com/symfony/symfony/releases/tag/v8.0.12https://github.com/symfony/symfony/security/advisories/GHSA-6qh9-h6wf-jgqc
2026-07-14
Published