CVE-2026-45073 Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
Attackers can manipulate SQL queries in Symfony's PdoAdapter to alter deletion scope or read data by influencing the namespace prefix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45073?
CVE-2026-45073 is a medium-severity SQL injection vulnerability in Sensiolabs Symfony, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion scope. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Weakness: CWE-89
Which versions are affected by CVE-2026-45073?
16 open source packages ship an affected version, including symfony/cache and symfony/symfony. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
symfony/cache Packagist | All versions | 5.4.52 |
symfony/cache Packagist | All versions | 5.4.52 |
symfony/cache Packagist | From 6.0.0 | 6.4.40 |
symfony/cache Packagist | From 6.0.0 | 6.4.40 |
symfony/cache Packagist | From 7.0.0 | 7.4.12 |
symfony/cache Packagist | From 7.0.0 | 7.4.12 |
10 more packages
symfony/cache Packagist | From 8.0.0 | 8.0.12 |
symfony/cache Packagist | From 8.0.0 | 8.0.12 |
symfony/symfony Packagist | All versions | 5.4.52 |
symfony/symfony Packagist | All versions | 5.4.52 |
symfony/symfony Packagist | From 6.0.0 | 6.4.40 |
symfony/symfony Packagist | From 6.0.0 | 6.4.40 |
symfony/symfony Packagist | From 7.0.0 | 7.4.12 |
symfony/symfony Packagist | From 7.0.0 | 7.4.12 |
symfony/symfony Packagist | From 8.0.0 | 8.0.12 |
symfony/symfony Packagist | From 8.0.0 | 8.0.12 |
Products include Sensiolabs Symfony.
How do I fix CVE-2026-45073?
Upgrade symfony/cache to a fixed version for your release line: 5.4.52, 6.4.40, 7.4.12 or 8.0.12.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-45073 being exploited?
There is no known exploitation of CVE-2026-45073 in the wild and no public exploit code.
Other vulnerabilities in Sensiolabs Symfony
Sources
Also known as DEBIAN-CVE-2026-45073, GHSA-6qh9-h6wf-jgqc, ROOT-APP-COMPOSER-CVE-2026-45073, UBUNTU-CVE-2026-45073.