Executive brief
A vulnerability in the Symfony UX Autocomplete library could allow unauthorized users to access sensitive data. The software fails to properly filter special characters in search queries, allowing an attacker to bypass intended search restrictions. This could result in the exposure of database information that was meant to remain private, such as internal record details or user data.
Technical details
The vulnerability exists in Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause(). The component builds SQL LIKE expressions by wrapping user-provided input in wildcards (%...%) without escaping special characters like '%', '_', or '\'. While the value is passed as a bound parameter (preventing traditional SQL injection), an attacker can use these wildcards to match any row or perform character-by-character enumeration (blind boolean oracle) against all searchable fields of an entity. This is particularly impactful because the BaseEntityAutocompleteType endpoint is public by default and searchable_fields often defaults to all entity properties. The issue is resolved in versions 2.36.0 and 3.1.0 by escaping wildcards and adding an explicit ESCAPE clause.
Affected products
- Symfony ux-autocomplete >= 2.2.0, < 2.36.0; >= 3.0.0, < 3.1.0
Timeline
- 2026-05-29: patched: Versions 2.36.0 and 3.1.0 released
- 2026-05-29: advisory: GitHub Security Advisory GHSA-946h-jp5c-8fvh published
- 2026-07-17: disclosed: CVE-2026-49211 published to NVD