CVE-2026-49211: Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
Description
Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping the SQL LIKE wildcards (%, , \). The value is passed as a bound parameter, so this is not SQL injection, but a client can send % to match every row or use as a single-character wildcard.
Because searchablefields defaults to every property of the entity and the autocomplete endpoint is public by default (BaseEntityAutocompleteType ships with security => false), an unauthenticated user can turn the endpoint into a broad matcher or a blind boolean oracle against every column of the entity, including columns the application never intended to expose.
Resolution
EntitySearchUtil now escapes \, %, and in the user-supplied query with addcslashes() and appends an explicit ESCAPE '\' clause to the generated LIKE expression, so those characters are matched literally. The exact-match wordsquery IN() branch is unchanged.
The patch for this issue is available here for branch 2.x (and forward-ported to 3.x).
Credits
Symfony would like to thank Pascal Cescon for reporting the issue and providing the fix.
Other sources
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards (%, , \), allowing unauthenticated users to turn the public BaseEntityAutocompleteType endpoint into a broad matcher or blind boolean oracle against every column in default searchablefields. This issue is fixed in versions 2.36.0 and 3.1.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/ux-autocompleteto a version that resolves this vulnerability.Fixed in 3.1.0 - Upgrade
Upgrade
composer/symfony/ux-autocompleteto a version that resolves this vulnerability.Fixed in 2.36.0 - Upgrade
Upgrade
Symfony UXto a version that resolves this vulnerability.Fixed in 2.36.0 - Upgrade
Upgrade
Symfony UXto a version that resolves this vulnerability.Fixed in 3.1.0 - Configuration
Upgrade to a fixed Symfony UX version (2.36.0 or 3.1.0) that implements the updated addSearchClause() behavior: escape \, %, _ in the query with addcslashes() and add an explicit `ESCAPE '\'` clause to the LIKE expression.
Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() SQL LIKE wildcard escaping and ESCAPE clause = Escape '\', '%', and '_' in the user-supplied query with addcslashes() and append `ESCAPE '\'` to the generated LIKE expression (so '%', '_' match literally instead of as wildcards)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49211?
CVE-2026-49211 has a medium severity rating of 6.9 according to the CVSS scoring system.
How do I fix CVE-2026-49211?
To fix CVE-2026-49211, update to the latest version of Symfony UX Autocomplete where the vulnerability is addressed.
What is the risk associated with CVE-2026-49211?
The risk associated with CVE-2026-49211 is categorized as 43, indicating potential exposure of sensitive information.
What type of vulnerability is CVE-2026-49211?
CVE-2026-49211 is an information exposure vulnerability that can lead to SQL injection through unescaped LIKE wildcards.
Which software is affected by CVE-2026-49211?
CVE-2026-49211 affects the Symfony UX Autocomplete component used in Symfony applications.