Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller‑supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion scope. Because the $prefix is interpolated directly into the SQL without binding or escaping, a caller who can influence $prefix can break out of the intended LIKE literal, alter the query’s semantics, or change the scope of rows deleted. This vulnerability permits arbitrary deletion of cache rows and could compromise data integrity if appropriate authorization controls are bypassed. The issue is a classic example of unsanitized input leading to a SQL injection flaw and is classified as CWE‑89. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Symfony framework components, including the cache component, released before 5.4.52, 6.4.40, 7.4.12, or 8.0.12. Any application using these older Symfony versions with dynamic cache prefixes is potentially affected.

The CVSS score is 6.3, indicating a moderate severity. The EPSS score is below 1 %, meaning documented exploitation is unlikely at this time, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be through application code that invokes doClear() with a caller‑supplied prefix, so the risk depends on how the prefix is sourced. If the prefix originates from untrusted user input or external systems, an attacker can construct a payload to delete arbitrary rows from tables that share the same prefix namespace.