CVE-2026-45073: Sensiolabs Symfony SQL Injection Vulnerability

CVE-2026-45073 Overview

CVE-2026-45073 is a SQL injection vulnerability [CWE-89] in the Symfony PHP framework's Cache component. The flaw resides in PdoAdapter::doClear(), which builds a DELETE statement using a namespace derived from the caller-supplied $prefix argument. The framework does not bind or escape this value, allowing a caller who can influence $prefix to break out of the LIKE literal and alter query semantics or expand the deletion scope. Symfony has published fixed releases in 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Critical Impact
An attacker able to control the cache prefix value can manipulate DELETE statement semantics, potentially causing deletion of unintended cache entries or altering query behavior in the underlying database.

Affected Products

Sensiolabs Symfony versions prior to 5.4.52
Sensiolabs Symfony versions prior to 6.4.40
Sensiolabs Symfony versions prior to 7.4.12 and 8.0.12

Discovery Timeline

2026-07-14 - CVE CVE-2026-45073 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45073

Vulnerability Analysis

The vulnerability affects the Symfony Cache component's PDO-backed adapter. When application code calls AbstractAdapter::clear($prefix), the value flows into PdoAdapter::doClear(), which composes a DELETE ... WHERE item_id LIKE ... statement by concatenating the namespace and prefix directly into the SQL string. The prefix is neither bound as a parameter nor escaped for use inside a LIKE literal.

An attacker who can influence the $prefix argument can inject characters that terminate the string literal and append arbitrary SQL fragments. This changes the DELETE statement's semantics or expands the scope of rows removed from the cache table. The impact is bounded by the cache table's schema and the database user's privileges, but data loss and cache poisoning workflows are achievable.

Root Cause

The root cause is missing input validation on the namespace prefix combined with unsafe SQL construction. Symfony trusted callers to supply a well-formed prefix string. The fix in commit ec50b799d79ebe24561f29351c1efcb6da95c9b1 introduces a strict character allowlist rejecting any prefix containing characters outside [-+.A-Za-z0-9] before the SQL is built.

Attack Vector

Exploitation requires that untrusted input reach the $prefix argument of AbstractAdapter::clear(). Applications that expose cache-clearing functionality through HTTP endpoints, admin panels, or multi-tenant namespace routing are the most likely exposure paths. The attacker sends a crafted prefix containing SQL metacharacters such as single quotes or LIKE wildcards.

php

                 $this->namespaceVersion = $namespaceVersion;
                 $this->ids = [];
             }
+        } elseif (preg_match('#[^-+.A-Za-z0-9]#', $prefix)) {
+            CacheItem::log($this->logger, 'Failed to clear the cache: Namespace-prefix contains invalid characters.', ['cache-adapter' => get_debug_type($this)]);
+
+            return false;
         } else {
             $namespaceToClear = $this->namespace.$prefix;
         }

Source: Symfony Commit ec50b79. The patch validates the prefix against an allowlist regex and refuses to build the SQL when invalid characters are present.

Detection Methods for CVE-2026-45073

Indicators of Compromise

Database log entries showing DELETE statements against the Symfony cache table with unexpected LIKE patterns or trailing SQL fragments.
Application logs containing the message Failed to clear the cache: Namespace-prefix contains invalid characters. after upgrading, indicating attempted exploitation.
Unexpected mass deletions of cache rows or missing cache entries triggering repeated backend recomputation.

Detection Strategies

Audit source code for calls to AbstractAdapter::clear() or PdoAdapter::doClear() where the prefix originates from HTTP parameters, headers, or user-controlled configuration.
Enable database query logging for the cache table and alert on DELETE statements containing single quotes, semicolons, or comment sequences within the LIKE clause.
Review web application firewall telemetry for requests to cache-management endpoints containing SQL metacharacters in prefix or namespace parameters.

Monitoring Recommendations

Track the volume of cache invalidations per unit time and alert on anomalous spikes that could indicate scope-expansion attacks.
Correlate PHP error logs and Symfony cache adapter warnings with database slow-query logs to identify malformed prefix values.
Monitor deployed Symfony package versions across the fleet using software composition analysis to confirm patched releases are in use.

How to Mitigate CVE-2026-45073

Immediate Actions Required

Upgrade Symfony to 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on the branch in use.
Audit application code paths that pass user-controlled data to any cache adapter clear() method and enforce server-side allowlists.
Restrict database privileges of the account used by the PDO cache adapter to the minimum required tables and operations.

Patch Information

The fix is available in Symfony releases v5.4.52, v6.4.40, v7.4.12, and v8.0.12. Full details are documented in GitHub Security Advisory GHSA-6qh9-h6wf-jgqc and the upstream commit.

Workarounds

Validate all cache prefix values against the same allowlist used by the patch: ^[-+.A-Za-z0-9]+$.
Avoid exposing cache namespace or prefix parameters through untrusted request surfaces and inject them from server-side configuration instead.
Deploy WAF rules that block SQL metacharacters in any parameter mapped to cache management endpoints until the upgrade completes.

bash

# Update Symfony Cache component via Composer
composer require symfony/cache:^7.4.12
# Or, for other maintained branches
composer require symfony/cache:^5.4.52
composer require symfony/cache:^6.4.40
composer require symfony/cache:^8.0.12

# Verify installed version
composer show symfony/cache | grep versions