CVE-2026-49208 symfony CVE debrief

Who should care

Developers and administrators using Symfony UX versions 2.8.0 to 2.36.0 and 3.1.0 should verify and apply patches to prevent potential security issues. This includes reviewing and updating business logic checks to handle date/time inputs securely and monitoring for any client-supplied input that could manipulate date/time values.

Technical summary

In Symfony UX, a security vulnerability exists in LiveComponentHydrator when handling DateTimeInterface types without explicit formats. Client-supplied relative strings like 'now' or '+10 years' can bypass time-based business logic checks, potentially leading to security issues. This is fixed in versions 2.36.0 and 3.1.0. Affected deployments should be verified, and patches applied to prevent exploitation.

Defensive priority

Medium priority due to CVSS score of 6.9 and potential impact on business logic checks.

Recommended defensive actions

• Verify and apply patches for Symfony UX to versions 2.36.0 or 3.1.0.
• Review and update business logic checks to handle date/time inputs securely.
• Monitor for any client-supplied input that could manipulate date/time values.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability and affected versions. Additional details can be found in the source references and GitHub advisories. To verify, defenders should review the official CVE record, NVD detail, and GitHub releases for Symfony UX. The vulnerability allows client-supplied relative strings to manipulate date/time values, potentially bypassing time-based business logic checks. Evidence is limited to public sources, and further verification may be necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.