CVE-2026-49208

CVE-2026-49208 (Symfony UX LiveComponent) : Vulnerability occurs when a writable #[LiveProp] is typed as DateTimeInterface with no explicit format, allowing client-supplied strings like now/tomorrow/+10 years to bypass checks via LiveComponentHydrator::hydrateObjectValue(), effectively moving tim...

ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor

Description When a LiveProp is typed as a DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue falls back to new $className$value. The DateTime / DateTimeImmutable constructors accept relative strings such as "now", "tomorrow",...

Improper Validation of Unsafe Equivalence in Input

Overview symfony/ux-live-component is a Live components for Symfony Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input via hydration of writable LiveProp properties typed as DateTimeInterface. An attacker can manipulate time-based application...

local file access in `Client:send` via manipulation of `$protocol` argument

security fix: hardened the Client::send method against misuse of the $method argument issue 81. Abusing its value, it was possible to force the client to access local files or connect to undesired urls instead of the intended target server's url the one used in the Client constructor. This weakne...