Cloudanix VulnDB

CVE-2026-45073

High · 7.1

Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

CVSS

7.1

EPSS

0.5%

Published

May 27, 2026

CISA due date

—

The record

`Symfony\Component\Cache\Adapter\PdoAdapter` is the PDO-backed cache adapter. Its `clear($prefix)` method (inherited from `AbstractAdapterTrait`) is documented to delete cache items whose key starts with `$prefix`. In the non-versioning code path, the caller-supplied `$prefix` is concatenated into `$namespace = $this->namespace.$prefix` and passed to `PdoAdapter::doClear()`, which builds: ```sql DELETE FROM <table> WHERE <id_col> LIKE '<namespace>%' ``` The value is interpolated directly into the SQL text and executed with `PDO::exec()`: `$namespace` is not bound. A caller able to influence `$prefix` can break out of the literal and inject SQL, expanding deletion scope from the intended prefix to arbitrary rows, or otherwise reshape query semantics. Most applications don't expose `clear($prefix)` to untrusted input directly, but the contract of the method is to safely accept any prefix string, so the lack of escaping is a defect of the adapter itself.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities