Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and no explicit format is configured, Symfony\\UX\\LiveComponent\\LiveComponentHydrator::hydrateObjectValue() falls back to new $className($value), allowing client‑supplied relative strings such as now, tomorrow, or +10 years to move a writable, format‑less date prop past time‑based business logic checks. This is an example of CWE-20: Improper Input Validation. This issue is fixed in versions 2.36.0 and 3.1.0.

The issue exists in the symfony/ux library for versions 2.8.0 up to, but not including, 2.36.0 and up to, but not including, 3.1.0. Any Symfony application that uses LiveComponent date properties typed as DateTimeInterface without specifying an explicit format is affected. The vulnerability is fixed in releases 2.36.0 and 3.1.0. No other vendors or product versions are affected.

The CVSS score of 6.9 indicates moderate severity, and suggests a very low probability of real‑world exploitation. The flaw is not listed in the CISA KEV catalog. Attackers can exploit this flaw by injecting relative date strings through any user‑controlled input that reaches the hydration code for a LiveProp without a format constraint. Based on the description, it is inferred that the attack vector is client‑side input that is bound to a LiveProp without a format constraint.