CVE-2026-49211: Symfony UX SQL Injection Vulnerability

CVE-2026-49211 Overview

CVE-2026-49211 affects Symfony UX, a JavaScript ecosystem for Symfony applications. The vulnerability resides in Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause(), which constructs a SQL LIKE expression for the autocomplete endpoint. The function wraps the client-supplied query in %...% without escaping the LIKE wildcards %, _, and \.

Unauthenticated users can abuse the public BaseEntityAutocompleteType endpoint as a broad matcher or a blind boolean oracle. Attackers can enumerate data across every column defined in the default searchable_fields configuration. The issue is categorized as information exposure [CWE-200].

Critical Impact
Unauthenticated attackers can turn public autocomplete endpoints into a blind oracle to enumerate sensitive database contents across searchable columns.

Affected Products

Symfony UX versions 2.2.0 through 2.35.x
Symfony UX version 3.0.0
Symfony UX Autocomplete component (symfony/ux-autocomplete)

Discovery Timeline

2026-07-17 - CVE-2026-49211 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-49211

Vulnerability Analysis

The vulnerability affects the Doctrine-backed autocomplete search utility in Symfony UX. When a client submits a query string, EntitySearchUtil::addSearchClause() composes the text_query parameter as '%'.$lowercaseQuery.'%' and binds it to a LIKE clause. Because the raw query is not escaped, SQL LIKE metacharacters retain their wildcard semantics.

An unauthenticated attacker can submit a single % to match all rows, or use patterns such as a% and _b to perform character-by-character enumeration. Combined with response differences from the autocomplete endpoint, this creates a blind boolean oracle against every column listed in searchable_fields. The default configuration exposes multiple fields per entity, widening the attack surface.

Root Cause

The root cause is missing sanitization of user-controlled input before insertion into a SQL LIKE pattern. The developer intent was substring matching, but the implementation trusts client input to be a literal string. There is no ESCAPE clause paired with the LIKE expression, so % and _ supplied by the client are interpreted as wildcards by the database engine.

Attack Vector

Exploitation requires only network access to a Symfony application exposing BaseEntityAutocompleteType. No authentication or user interaction is needed. An attacker crafts query strings containing LIKE metacharacters and observes result set changes to infer field values across searchable columns.

php

// Security patch in src/Autocomplete/src/Doctrine/EntitySearchUtil.php
// [Autocomplete] Escape LIKE wildcards in the search query
            // adding '0' turns the string into a numeric value
            'numeric_query' => is_numeric($query) ? 0 + $query : $query,
            'uuid_query' => $query,
-           'text_query' => '%'.$lowercaseQuery.'%',
+           // escape the LIKE wildcards "%" and "_" (and the escape char "\")
+           // so a user-supplied wildcard cannot broaden the search; paired
+           // with the "ESCAPE '\'" clause on the LIKE expression below
+           'text_query' => '%'.addcslashes($lowercaseQuery, '\\%_').'%',
            'words_query' => explode(' ', $lowercaseQuery),
        ];
// Source: https://github.com/symfony/ux/commit/725ab3d40689c91ff19ad2d01940a30007769214

The patch applies addcslashes($lowercaseQuery, '\\%_') to neutralize wildcard characters and pairs the LIKE expression with an ESCAPE '\' clause so escaped characters are treated as literals.

Detection Methods for CVE-2026-49211

Indicators of Compromise

Autocomplete endpoint requests containing unescaped % or _ characters in the query parameter.
High-volume, low-variance requests to BaseEntityAutocompleteType endpoints from a single source.
Sequential query patterns such as a%, b%, aa%, ab% indicating enumeration behavior.

Detection Strategies

Inspect web server and application logs for autocomplete query strings that include LIKE metacharacters %, _, or \.
Alert on repeated short-string queries against autocomplete routes originating from unauthenticated sessions.
Correlate response size and result counts to detect oracle-style probing that toggles between empty and populated result sets.

Monitoring Recommendations

Baseline normal autocomplete query lengths and character sets, then flag deviations.
Enable request-rate monitoring on public autocomplete endpoints and apply thresholds per source IP.
Review database query logs for LIKE patterns bound with unusually broad wildcards on searchable entity fields.

How to Mitigate CVE-2026-49211

Immediate Actions Required

Upgrade symfony/ux-autocomplete to version 2.36.0 or 3.1.0, which include the wildcard escaping fix.
Audit all Symfony entities using BaseEntityAutocompleteType and review the configured searchable_fields.
Restrict access to autocomplete endpoints that expose sensitive columns until the upgrade is applied.

Patch Information

The fix is delivered in commit 725ab3d40689c91ff19ad2d01940a30007769214 and shipped in Symfony UX v2.36.0 and Symfony UX v3.1.0. Details are provided in GitHub Security Advisory GHSA-946h-jp5c-8fvh.

Workarounds

Override EntitySearchUtil::addSearchClause() and apply addcslashes($query, '\\%_') before the value is bound to the LIKE clause.
Narrow searchable_fields to reduce the columns exposed by the autocomplete endpoint until patching completes.
Add a Web Application Firewall (WAF) rule to strip or reject % and _ characters in autocomplete query parameters.

bash

# Update Symfony UX Autocomplete via Composer
composer require symfony/ux-autocomplete:^2.36.0
# or for the 3.x branch
composer require symfony/ux-autocomplete:^3.1.0

# Verify installed version
composer show symfony/ux-autocomplete | grep versions