Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

🗓️ 27 May 2026 21:11:22Reported by GitHub Advisory DatabaseType

Symfony fixes injection risk in cache clear by rejecting invalid prefixes.

Reporter	Title	Published	Views	Family All 23
attackerkb	CVE-2026-45073	14 Jul 202618:23	–	attackerkb
circl	CVE-2026-45073	20 May 202611:00	–	circl
cve	CVE-2026-45073	14 Jul 202618:23	–	cve
cvelist	CVE-2026-45073 Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix	14 Jul 202618:23	–	cvelist
debian	[SECURITY] [DSA 6312-1] symfony security update	31 May 202612:26	–	debian
debian	[SECURITY] [DSA 6317-1] symfony security update	1 Jun 202618:04	–	debian
debiancve	CVE-2026-45073	1 Jan 197000:00	–	debiancve
nessus	Debian dsa-6312 : php-symfony - security update	1 Jun 202600:00	–	nessus
nessus	Debian dsa-6317 : php-symfony - security update	2 Jun 202600:00	–	nessus
nessus	Linux Distros Unpatched Vulnerability : CVE-2026-45073	22 May 202600:00	–	nessus

Vulners

Node

symfony symfonyRange8.0.0–8.0.12composer

symfony symfonyRange7.0.0–7.4.12composer

symfony symfonyRange6.0.0–6.4.40composer

symfony symfonyRange<5.4.52composer

symfony cacheRange8.0.0–8.0.12composer

symfony cacheRange7.0.0–7.4.12composer

symfony cacheRange6.0.0–6.4.40composer

symfony cacheRange<5.4.52composer

Source	Link
github	www.github.com/symfony/symfony/security/advisories/GHSA-6qh9-h6wf-jgqc
github	www.github.com/symfony/symfony/commit/ec50b799d79ebe24561f29351c1efcb6da95c9b
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2026-45073.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45073.yaml
symfony	www.symfony.com/cve-2026-45073
github	www.github.com/advisories/GHSA-6qh9-h6wf-jgqc

27 May 2026 21:11Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.3

CVSS 46.3

EPSS0.0041

SSVC