Log in Start free

Vulnerability · Published Jul 17, 2026 · Assigned by GitHub_M

CVE-2026-49211Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil

Medium 6.9

In plain English

A medium-severity information exposure in ux from symfony. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.5%top 54.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards (%, _, \), allowing unauthenticated users to turn the public BaseEntityAutocompleteType endpoint into a broad matcher or blind boolean oracle against every column in default searchable_fields. This issue is fixed in versions 2.36.0 and 3.1.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistsymfony/ux-autocomplete2.36.0GHSA-946h-jp5c-8fvh
Packagistsymfony/ux-autocomplete3.1.0GHSA-946h-jp5c-8fvh

Affected products (as reported)

VendorProductVersions
symfony ux >= 3.0.0, < 3.1.0>= 2.2.0, < 2.36.0

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References