CVE-2026-45073
Full vulnerability record from the local CVENow database.
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion scope. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Severity
MEDIUM
CVSS score
6.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-14 19:17:06.413000
Last modified
2026-10-24 21:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-45073",
"sourceIdentifier": "[email protected]",
"published": "2026-07-14T19:17:06.413",
"lastModified": "2026-10-24T21:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion scope. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12."
},
{
"lang": "es",
"value": "Symfony es un framework PHP para aplicaciones web y de consola y un conjunto de componentes PHP reutilizables. Antes de las versiones 5.4.52, 6.4.40, 7.4.12 y 8.0.12, PdoAdapter::doClear() construye una sentencia DELETE utilizando un espacio de nombres derivado del $prefix proporcionado por el llamador sin vincularlo ni escaparlo, permitiendo que un llamador capaz de influir en $prefix se salga del literal LIKE y altere la semántica de la consulta o el alcance de la eliminación. Este problema se ha solucionado en las versiones 5.4.52, 6.4.40, 7.4.12 y 8.0.12."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "symfony",
"product": "symfony",
"versions": [
{
"version": "< 5.4.52",
"status": "affected"
},
{
"version": ">= 6.0.0-BETA1, < 6.4.40",
"status": "affected"
},
{
"version": ">= 7.0.0-BETA1, < 7.4.12",
"status": "affected"
},
{
"version": ">= 8.0.0-BETA1, < 8.0.12",
"status": "affected"
}
]
},
{
"vendor": "cache",
"product": "symfony",
"versions": [
{
"version": "< 5.4.52",
"status": "affected"
},
{
"version": ">= 6.0.0-BETA1, < 6.4.40",
"status": "affected"
},
{
"version": ">= 7.0.0-BETA1, < 7.4.12",
"status": "affected"
},
{
"version": ">= 8.0.0-BETA1, < 8.0.12",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-14T19:14:35.344970Z",
"id": "CVE-2026-45073",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.52",
"matchCriteriaId": "219B6657-31F0-4BA4-837F-F41B88A255B4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.0",
"versionEndExcluding": "6.4.40",
"matchCriteriaId": "D8E75C0E-A396-4B8E-831C-F869181948EE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.0",
"versionEndExcluding": "7.4.12",
"matchCriteriaId": "F70A408A-E0B5-48A8-AA3A-4F9DE365BB56"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.0.0",
"versionEndExcluding": "8.0.12",
"matchCriteriaId": "6AF5BEE2-34A1-4C5D-8544-8BC68C9EDDFA"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/symfony/symfony/commit/ec50b799d79ebe24561f29351c1efcb6da95c9b1",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/symfony/symfony/releases/tag/v5.4.52",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://github.com/symfony/symfony/releases/tag/v6.4.40",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://github.com/symfony/symfony/releases/tag/v7.4.12",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://github.com/symfony/symfony/releases/tag/v8.0.12",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-6qh9-h6wf-jgqc",
"source": "[email protected]",
"tags": [
"Patch",
"Vendor Advisory"
]
}
]
}