CVE-2026-49211

Name of the Vulnerable Software and Affected Versions Symfony UX versions 2.2.0 through 2.35.0

Description In the SymfonyUXAutocompleteDoctrineEntitySearchUtil::addSearchClause() function, the LIKE expression for the autocomplete endpoint is constructed by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards such as %, , and ``. While the value is passed as a bound parameter, preventing SQL injection, an unauthenticated user can utilize these wildcards to transform the public BaseEntityAutocompleteType endpoint into a broad matcher or a blind boolean oracle. This allows the user to query every column in the default searchable fields, potentially exposing data the application did not intend to make public.

Recommendations Update to version 2.36.0 or 3.1.0.