CVE-2026-49215
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A vulnerability in Symfony UX allows CSRF attacks on LiveComponent components. The protection mechanism relies on the Accept header, which can be set by an attacker in a cross-origin request without preflight, enabling unauthorized actions on a victim's session.
Risk Assessment
An attacker can exploit this flaw to perform unauthorized operations on a user's account if the application uses SameSite=None cookies, credentials: 'include', or a permissive cookie policy. This could lead to data theft, content modification, or privilege escalation.
Recommendation
Immediately update Symfony UX to version 2.36.0 or 3.1.0. Additionally, consider strengthening cookie policies (SameSite=Lax/Strict) and implementing additional CSRF mechanisms (e.g., tokens).
Other vulnerabilities in Symfony UX
See all- CVE-2026-49212High
A vulnerability in Symfony UX allows an attacker to swap a signed data blob between components or slots, enabling the setting of read-only properties on a target component. Affected versions are from 2.8.0 to 2.36.0 and 3.1.0.
- CVE-2026-49211High
A vulnerability in Symfony UX allows unauthenticated users to turn the public autocomplete endpoint into a broad matcher or blind boolean oracle. The issue is due to missing escaping of SQL LIKE wildcards (% , _ , \) in the client-supplied query.
- CVE-2026-49210Medium
A vulnerability in Symfony UX allows arbitrary HTML injection, including <script> tags, during Live Component re-rendering. The client-controlled children[id].tag value is interpolated directly into HTML without escaping or validation.
- CVE-2026-49209Medium
A vulnerability in Symfony UX allows an authenticated client to send a single _batch request with thousands of actions, exhausting server resources (CPU, memory, database connections) due to unbounded iteration over the actions array.
- CVE-2026-49208Medium
A vulnerability in Symfony UX allows an attacker to manipulate dates by sending relative strings (e.g., now, tomorrow, +10 years) to a LiveProp of type DateTimeInterface without a configured format. This bypasses time-based business logic checks.
- CVE-2026-55878High
A vulnerability in Symfony UX allows writing files to arbitrary locations or reading local files outside the recipe directory via a crafted recipe kit. The issue affects the ux:install console command which uses Path::isRelative() accepting paths like ../../../etc.
- CVE-2026-55877Medium
A vulnerability in Symfony UX allows XSS via the ux_icon() Twig function, which marks output as safe (is_safe=['html']) and embeds SVG source verbatim. Unsanitized local SVG files or Iconify JSON responses can contain malicious scripts, event handlers, or dangerous URL schemes.
Original NVD description (English source)
Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventListener\LiveComponentSubscriber::isLiveComponentRequest() gates #[LiveAction] invocations on Accept: application/vnd.live-component+html, but the Accept header is CORS-safelisted and cross-origin fetch() can set it without preflight, allowing forged cross-origin #[LiveAction] requests against a victim session when applications use SameSite=None, credentials: 'include', a permissive cookie policy, or a same-origin pivot. This issue is fixed in versions 2.36.0 and 3.1.0.