Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion scope. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/symfony/symfony/commit/ec50b799d79ebe24561f29351c1efcb6da95c9b1 Patch
- https://github.com/symfony/symfony/security/advisories/GHSA-6qh9-h6wf-jgqc Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.3 · sensiolabsNVD modified 2026-10-24 21:10
Affected (CPE criteria) 1
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
References 6
- https://github.com/symfony/symfony/commit/ec50b799d79ebe24561f29351c1efcb6da95c9b1 Patch
- https://github.com/symfony/symfony/releases/tag/v5.4.52 Product, Release Notes
- https://github.com/symfony/symfony/releases/tag/v6.4.40 Product, Release Notes
- https://github.com/symfony/symfony/releases/tag/v7.4.12 Product, Release Notes
- https://github.com/symfony/symfony/releases/tag/v8.0.12 Product, Release Notes
- https://github.com/symfony/symfony/security/advisories/GHSA-6qh9-h6wf-jgqc Patch, Vendor Advisory