CVE-2026-45073

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-45073

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45073.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-45073

Aliases

GHSA-6qh9-h6wf-jgqc

Downstream

Published

2026-07-14T18:23:41Z

Modified

2026-10-22T02:49:08Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

Details

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion scope. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-89"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45073.json"
}

References

Affected packages

Git / github.com/symfony/symfony

Affected ranges

Type

GIT

Repo

https://github.com/symfony/symfony

Events

Introduced

Fixed

eabc5f9ed7831fe6de8d609c5ebc29aed1f8ef8f

Introduced

aa4e97099b5a67bdc9f2387fe8d099f5c712f81c

Fixed

95a951788e30c45356278f4e4472cbbf552d0eb9

Introduced

d78c5f403d7ee794993660b1d5155536edd36fc1

Fixed

275f5cbccbcc50205206f05e599c4f57009aadb8

Introduced

2e913a829cfbbf9cb38b321bdff1806b44b192eb

Fixed

06d3b2c9a8aeb5d8493738cc51e24f6a1215827c

Fixed

ec50b799d79ebe24561f29351c1efcb6da95c9b1

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "5.4.52"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "6.0.0"
                },
                {
                    "fixed":  "6.4.40"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0"
                },
                {
                    "fixed":  "7.4.12"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "8.0.0"
                },
                {
                    "fixed":  "8.0.12"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "ec50b799d79ebe24561f29351c1efcb6da95c9b1"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v5.4.52",
            "range":  [
                {
                    "fixed":  "eabc5f9ed7831fe6de8d609c5ebc29aed1f8ef8f"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v6.4.40",
            "range":  [
                {
                    "fixed":  "95a951788e30c45356278f4e4472cbbf552d0eb9"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v7.4.12",
            "range":  [
                {
                    "fixed":  "275f5cbccbcc50205206f05e599c4f57009aadb8"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v8.0.12",
            "range":  [
                {
                    "fixed":  "06d3b2c9a8aeb5d8493738cc51e24f6a1215827c"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2.*

v2.0.0

v2.0.0-RC1

v2.0.0-RC2

v2.0.0-RC3

v2.0.0-RC4

v2.0.0-RC5

v2.0.0-RC6

v2.0.0BETA1

v2.0.0BETA2

v2.0.0BETA3

v2.0.0BETA4

v2.0.0BETA5

v2.0.0PR8

v2.1.0

v2.1.0-BETA1

v2.1.0-BETA2

v2.1.0-BETA3

v2.1.0-BETA4

v2.1.0-RC1

v2.1.0-RC2

v2.2.0-BETA1

v2.2.0-BETA2

v2.3.0-BETA1

v2.3.0-BETA2

v2.4.0-BETA1

v2.4.0-BETA2

v2.5.0-BETA1

v2.5.0-BETA2

v2.6.0-BETA1

v3.*

v3.0.0

v3.0.0-BETA1

v3.2.0-BETA1

v3.2.0-RC1

v3.3.0-BETA1

v4.*

v4.0.0-BETA1

v4.0.0-BETA2

v4.0.0-BETA3

v4.0.0-BETA4

v4.2.0-BETA1

v4.2.0-BETA2

v4.3.0-BETA1

v5.*

v5.0.0-BETA1

v5.0.0-BETA2

v5.0.0-RC1

v5.1.0-BETA1

v5.2.0-BETA1

v5.2.0-BETA2

v5.2.0-BETA3

v5.3.0-BETA1

v5.3.0-BETA2

v5.3.0-BETA3

v5.3.0-BETA4

v5.4.0

v5.4.0-BETA1

v5.4.0-BETA2

v5.4.0-BETA3

v5.4.0-RC1

v5.4.1

v5.4.10

v5.4.11

v5.4.12

v5.4.13

v5.4.14

v5.4.15

v5.4.16

v5.4.17

v5.4.18

v5.4.19

v5.4.2

v5.4.20

v5.4.21

v5.4.22

v5.4.23

v5.4.24

v5.4.25

v5.4.26

v5.4.27

v5.4.28

v5.4.29

v5.4.3

v5.4.30

v5.4.31

v5.4.32

v5.4.33

v5.4.34

v5.4.35

v5.4.36

v5.4.37

v5.4.38

v5.4.39

v5.4.4

v5.4.40

v5.4.41

v5.4.42

v5.4.43

v5.4.44

v5.4.45

v5.4.46

v5.4.47

v5.4.48

v5.4.49

v5.4.5

v5.4.50

v5.4.51

v5.4.6

v5.4.7

v5.4.8

v5.4.9

v6.*

v6.0.0-BETA1

v6.0.0-BETA2

v6.0.0-BETA3

v6.0.0-RC1

v6.1.0-BETA1

v6.1.0-BETA2

v6.1.0-RC1

v6.2.0-BETA1

v6.2.0-BETA2

v6.2.0-BETA3

v6.3.0-BETA1

v6.3.0-BETA2

v6.3.0-BETA3

v6.3.0-RC1

v6.4.0

v6.4.0-BETA1

v6.4.0-BETA2

v6.4.0-BETA3

v6.4.0-RC1

v6.4.0-RC2

v6.4.1

v6.4.10

v6.4.11

v6.4.12

v6.4.13

v6.4.14

v6.4.15

v6.4.16

v6.4.17

v6.4.18

v6.4.19

v6.4.2

v6.4.20

v6.4.21

v6.4.22

v6.4.23

v6.4.24

v6.4.25

v6.4.26

v6.4.27

v6.4.28

v6.4.29

v6.4.3

v6.4.30

v6.4.31

v6.4.32

v6.4.33

v6.4.34

v6.4.35

v6.4.36

v6.4.37

v6.4.38

v6.4.39

v6.4.4

v6.4.5

v6.4.6

v6.4.7

v6.4.8

v6.4.9

v7.*

v7.0.0-BETA1

v7.0.0-BETA2

v7.0.0-BETA3

v7.0.0-RC1

v7.1.0-BETA1

v7.1.0-RC1

v7.2.0-BETA1

v7.2.0-BETA2

v7.2.0-RC1

v7.3.0-BETA1

v7.3.0-BETA2

v7.3.0-RC1

v7.4.0

v7.4.0-BETA1

v7.4.0-BETA2

v7.4.0-RC1

v7.4.0-RC2

v7.4.0-RC3

v7.4.1

v7.4.10

v7.4.11

v7.4.2

v7.4.3

v7.4.4

v7.4.5

v7.4.6

v7.4.7

v7.4.8

v7.4.9

v8.*

v8.0.0

v8.0.1

v8.0.10

v8.0.11

v8.0.2

v8.0.3

v8.0.4

v8.0.5

v8.0.6

v8.0.7

v8.0.8

v8.0.9

Other

vPR3

vPR4

vPR5

vPR6

vPR8

vPR9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45073.json"