CVE-2026-45073: Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
Description
Symfony\Component\Cache\Adapter\PdoAdapter is the PDO-backed cache adapter. Its clear($prefix) method (inherited from AbstractAdapterTrait) is documented to delete cache items whose key starts with $prefix.
In the non-versioning code path, the caller-supplied $prefix is concatenated into $namespace = $this->namespace.$prefix and passed to PdoAdapter::doClear(), which builds:
sql DELETE FROM <table> WHERE <idcol> LIKE '<namespace>%'
The value is interpolated directly into the SQL text and executed with PDO::exec(): $namespace is not bound. A caller able to influence $prefix can break out of the literal and inject SQL, expanding deletion scope from the intended prefix to arbitrary rows, or otherwise reshape query semantics.
Most applications don't expose clear($prefix) to untrusted input directly, but the contract of the method is to safely accept any prefix string, so the lack of escaping is a defect of the adapter itself.
Resolution
AbstractAdapterTrait::clear() now rejects any $prefix containing characters outside [-+.A-Za-z0-9]: when an invalid prefix is supplied, the method logs a warning and returns false instead of reaching the SQL layer. This blocks quotes, %, null bytes and other characters that would let an attacker break out of the LIKE literal.
The patch for this issue is available here for branch 5.4.
Credits Symfony would like to thank secsyscodex for reporting the issue and Nicolas Grekas for fixing it.
Other sources
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion scope. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
composer/symfony/cacheto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/cacheto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/cacheto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/cacheto a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
Symfony (Symfony Cache PdoAdapter via AbstractAdapterTrait::clear)to a version that resolves this vulnerability.Fixed in 5.4.52 - Upgrade
Upgrade
Symfony (Symfony Cache PdoAdapter via AbstractAdapterTrait::clear)to a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
Symfony (Symfony Cache PdoAdapter via AbstractAdapterTrait::clear)to a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
Symfony (Symfony Cache PdoAdapter via AbstractAdapterTrait::clear)to a version that resolves this vulnerability.Fixed in 8.0.12 - Configuration
Ensure AbstractAdapterTrait::clear() rejects any $prefix containing characters outside `[-+.A-Za-z0-9]`, logs a warning, and returns false instead of executing the SQL DELETE in PdoAdapter::doClear().
Symfony\Component\Cache\Adapter\PdoAdapter (AbstractAdapterTrait::clear) $prefix validation (reject characters outside `[-+.A-Za-z0-9]`) = enabled/reject invalid prefixes
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45073?
CVE-2026-45073 has a risk rating of 37, indicating a significant vulnerability.
What type of vulnerability is CVE-2026-45073?
CVE-2026-45073 is classified as an SQL Injection vulnerability.
How do I fix CVE-2026-45073?
To fix CVE-2026-45073, update to the latest version of Symfony that addresses this vulnerability.
What components are affected by CVE-2026-45073?
CVE-2026-45073 affects the Symfony component, specifically the PDO-backed cache adapter.
What is the impact of CVE-2026-45073?
The impact of CVE-2026-45073 allows attackers to potentially manipulate SQL queries through improperly handled user input.