symfony/cache vulnerabilities

Latest symfony/cache CVEs

Newest publication first

1. CVE-2026-45073 Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

   Published 2026-07-14

   Medium·CVSS 6.3 EPSS 0.46% PoC

   Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it...

2. CVE-2019-18889 Symfony Unsafe Cache Serialization Could Enable RCE

   Published 2019-11-21

   Critical·CVSS 9.8 EPSS 33.2% PoC

   An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.

3. CVE-2019-10912 Deserialization of untrusted data in Symfony

   Published 2019-05-16

   High·CVSS 7.1 EPSS 2.3% PoC

   In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is re...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.