CVE-2026-49211

Katalog CVE

CVSS 7.5 · High EPSS 0,53%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada symfony ux. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards (%, _, \), allowing unauthenticated users to turn the public BaseEntityAutocompleteType endpoint into a broad matcher or blind boolean oracle against every column in default searchable_fields. This issue is fixed in versions 2.36.0 and 3.1.0.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

20 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/ux/security/advisories/GHSA-946h-jp5c-8fvh advisory vendor
• https://github.com/symfony/ux/commit/725ab3d40689c91ff19ad2d01940a30007769214 patch
• https://github.com/symfony/ux/releases/tag/v2.36.0 release notes
• https://github.com/symfony/ux/releases/tag/v3.1.0 release notes