CVE-2026-45073CWE-89

Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

Medium · published July 14, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
38.7
In the wild
Unconfirmed
What it is

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion scope. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00458 · 38.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-07-14T18:23Z
EPSS history
Timeline
  • 14 JUL 18:23Z
    Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
    cvelistv5