CVE-2026-49208

Katalog CVE

CVSS 5.3 · Medium EPSS 0,41%

Kerentanan Improper Input Validation pada symfony ux. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue() falls back to new $className($value), allowing client-supplied relative strings such as now, tomorrow, or +10 years to move a writable, format-less date prop past time-based business logic checks. This issue is fixed in versions 2.36.0 and 3.1.0.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/ux/security/advisories/GHSA-89g7-22c8-3j23 advisory vendor
• https://github.com/symfony/ux/commit/d24d78fda6df2d5964312255943ebf3a217b79a2 patch
• https://github.com/symfony/ux/releases/tag/v2.36.0 release notes
• https://github.com/symfony/ux/releases/tag/v3.1.0 release notes