CVE-2026-49208

Name of the Vulnerable Software and Affected Versions Symfony UX versions 2.8.0 through 2.35.0 Symfony UX versions 3.0.0 through 3.0.x

Description When a #[LiveProp] is typed as a DateTimeInterface and no explicit format is configured, the function hydrateObjectValue() in SymfonyUXLiveComponentLiveComponentHydrator falls back to new $className($value). Because DateTime and DateTimeImmutable constructors accept relative strings such as now, tomorrow, or +10 years, a client can manipulate a writable, format-less date prop to an arbitrary point in time. This allows an attacker to bypass time-based business logic checks by providing a frontend payload that is not a valid date.

Recommendations Update Symfony UX to version 2.36.0. Update Symfony UX to version 3.1.0.