Executive brief
A vulnerability in Symfony UX LiveComponent allows users to bypass time-based business rules by submitting relative date strings like 'tomorrow' or '+10 years' instead of specific dates. This occurs because the software was too flexible in how it interpreted date information provided by the web browser. An attacker could use this to manipulate date-sensitive logic, such as bypassing expiration checks or scheduling actions at unauthorized times. The issue is resolved by updating to the latest versions of the library.
Technical details
A vulnerability exists in Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue() where #[LiveProp] properties typed as DateTimeInterface without an explicit format fall back to the PHP DateTime constructor. Because this constructor accepts relative strings (e.g., 'now', '+1 year'), a remote attacker can supply arbitrary relative time values to manipulate writable date properties. This allows the client to move date-based state past server-side business logic checks. The fix enforces strict RFC 3339 parsing for format-less date properties, ensuring consistency between dehydration and hydration.
Affected products
- Symfony ux-live-component >= 2.8.0, < 2.36.0; >= 3.0.0, < 3.1.0
Timeline
- 2026-05-29: patched: Fixed in versions 2.36.0 and 3.1.0
- 2026-05-29: advisory: GitHub Security Advisory GHSA-89g7-22c8-3j23 published
- 2026-07-17: disclosed: CVE-2026-49208 published to NVD