CVE-2026-49208: Symfony UX LiveComponent improper input validation in date hydration

CVE-2026-49208 · Severity: medium · CVSS 4 · Published 2026-07-17

A vulnerability in Symfony UX LiveComponent allows users to bypass time-based business rules by submitting relative date strings like 'tomorrow' or '+10 years' instead of specific dates. This occurs because the software was too flexible in how it interpreted date information provided by the web browser. An attacker could use this to manipulate date-sensitive logic, such as bypassing expiration checks or scheduling actions at unauthorized times. The issue is resolved by updating to the latest versions of the library.

Technologies: symfony/ux-live-component (Packagist), Symfony UX Live Component. Vendors: Packagist, Symfony.

Quick answers

Is CVE-2026-49208 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49208 being exploited in the wild.
How severe is CVE-2026-49208?
Medium severity, with a CVSS score of 4, published 17 July 2026.
Which products and versions are affected?
symfony/ux-live-component (Packagist) ECOSYSTEM:introduced=2.8.0,fixed=2.36.0; Symfony UX Live Component >= 2.8.0, < 2.36.0; >= 3.0.0, < 3.1.0.
Is there a fix for CVE-2026-49208?
Yes. symfony/ux-live-component (Packagist): upgrade to 2.36.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49208 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49208?
Check whether you run symfony/ux-live-component (Packagist) or Symfony UX Live Component at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • symfony/ux-live-component (Packagist): upgrade to 2.36.0 or later
    composer require symfony/ux-live-component:^2.36.0

Technical details

A vulnerability exists in Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue() where #[LiveProp] properties typed as DateTimeInterface without an explicit format fall back to the PHP DateTime constructor. Because this constructor accepts relative strings (e.g., 'now', '+1 year'), a remote attacker can supply arbitrary relative time values to manipulate writable date properties. This allows the client to move date-based state past server-side business logic checks. The fix enforces strict RFC 3339 parsing for format-less date properties, ensuring consistency between dehydration and hydration.

Affected products

  • Symfony ux-live-component >= 2.8.0, < 2.36.0; >= 3.0.0, < 3.1.0

Identifiers

  • CVE-2026-49208
  • GHSA-89g7-22c8-3j23

Timeline

  • 2026-05-29: patched: Fixed in versions 2.36.0 and 3.1.0
  • 2026-05-29: advisory: GitHub Security Advisory GHSA-89g7-22c8-3j23 published
  • 2026-07-17: disclosed: CVE-2026-49208 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.