CVE-2026-49211: Symfony UX Autocomplete information exposure via unescaped LIKE wildcards

CVE-2026-49211 · Severity: medium · CVSS 4 · Published 2026-07-17

A vulnerability in the Symfony UX Autocomplete library could allow unauthorized users to access sensitive data. The software fails to properly filter special characters in search queries, allowing an attacker to bypass intended search restrictions. This could result in the exposure of database information that was meant to remain private, such as internal record details or user data.

Technologies: symfony/ux-autocomplete (Packagist). Vendors: Packagist, Symfony.

Quick answers

Is CVE-2026-49211 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49211 being exploited in the wild.
How severe is CVE-2026-49211?
Medium severity, with a CVSS score of 4, published 17 July 2026.
Which products and versions are affected?
symfony/ux-autocomplete (Packagist) ECOSYSTEM:introduced=2.2.0,fixed=2.36.0; Symfony UX Autocomplete >= 2.2.0, < 2.36.0; >= 3.0.0, < 3.1.0.
Is there a fix for CVE-2026-49211?
Yes. symfony/ux-autocomplete (Packagist): upgrade to 2.36.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49211 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49211?
Check whether you run symfony/ux-autocomplete (Packagist) or Symfony UX Autocomplete at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • symfony/ux-autocomplete (Packagist): upgrade to 2.36.0 or later
    composer require symfony/ux-autocomplete:^2.36.0

Technical details

The vulnerability exists in Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause(). The component builds SQL LIKE expressions by wrapping user-provided input in wildcards (%...%) without escaping special characters like '%', '_', or '\'. While the value is passed as a bound parameter (preventing traditional SQL injection), an attacker can use these wildcards to match any row or perform character-by-character enumeration (blind boolean oracle) against all searchable fields of an entity. This is particularly impactful because the BaseEntityAutocompleteType endpoint is public by default and searchable_fields often defaults to all entity properties. The issue is resolved in versions 2.36.0 and 3.1.0 by escaping wildcards and adding an explicit ESCAPE clause.

Affected products

  • Symfony ux-autocomplete >= 2.2.0, < 2.36.0; >= 3.0.0, < 3.1.0

Identifiers

  • CVE-2026-49211
  • GHSA-946h-jp5c-8fvh

Timeline

  • 2026-05-29: patched: Versions 2.36.0 and 3.1.0 released
  • 2026-05-29: advisory: GitHub Security Advisory GHSA-946h-jp5c-8fvh published
  • 2026-07-17: disclosed: CVE-2026-49211 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.