High severity7.3OSV Advisory· Published Jul 14, 2026· Updated Jul 15, 2026
CVE-2026-45073
CVE-2026-45073
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion scope. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
symfony/cachePackagist | < 5.4.52 | 5.4.52 |
symfony/cachePackagist | >= 6.0.0, < 6.4.40 | 6.4.40 |
symfony/cachePackagist | >= 7.0.0, < 7.4.12 | 7.4.12 |
symfony/cachePackagist | >= 8.0.0, < 8.0.12 | 8.0.12 |
symfony/symfonyPackagist | < 5.4.52 | 5.4.52 |
symfony/symfonyPackagist | >= 6.0.0, < 6.4.40 | 6.4.40 |
symfony/symfonyPackagist | >= 7.0.0, < 7.4.12 | 7.4.12 |
symfony/symfonyPackagist | >= 8.0.0, < 8.0.12 | 8.0.12 |
Affected products
1- Range: v5.4.51, v8.0.11, v7.4.11, …
Patches
Vulnerability mechanics
References
11- github.com/symfony/symfony/commit/ec50b799d79ebe24561f29351c1efcb6da95c9b1nvdPatch
- github.com/symfony/symfony/security/advisories/GHSA-6qh9-h6wf-jgqcnvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-6qh9-h6wf-jgqcghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2026-45073.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45073.yamlghsaWEB
- github.com/symfony/symfony/commit/ec50b799d79ebe24561f29351c1efcb6da95c9bghsaWEB
- github.com/symfony/symfony/releases/tag/v5.4.52nvdProductRelease Notes
- github.com/symfony/symfony/releases/tag/v6.4.40nvdProductRelease Notes
- github.com/symfony/symfony/releases/tag/v7.4.12nvdProductRelease Notes
- github.com/symfony/symfony/releases/tag/v8.0.12nvdProductRelease Notes
- symfony.com/cve-2026-45073ghsaWEB
News mentions
0No linked articles in our index yet.