Symfony UX’s autocomplete component, which is part of the Symfony JavaScript ecosystem, builds a SQL LIKE expression by wrapping the client‑supplied query in %…% without escaping SQL LIKE wildcards (%, _, \) in the EntitySearchUtil::addSearchClause method. This flaw allows unauthenticated users to query the public BaseEntityAutocompleteType endpoint, turning it into a broad matcher or blind Boolean oracle for every column in the default searchable fields. As a result, attackers can enumerate data or extract portions of the database, exposing confidential information. The issue is present in Symfony UX versions 2.2.0 through 2.36.0 and 3.0.0 through 3.1.0 and has been fixed in releases 2.36.0 and 3.1.0.

Versions of Symfony UX from 2.2.0 up to but excluding 2.36.0, and from 3.0.0 up to but excluding 3.1.0 are vulnerable. The issue arises in the EntitySearchUtil::addSearchClause method used by the BaseEntityAutocompleteType route. The vulnerability was addressed in releases 2.36.0 and 3.1.0, where the LIKE wildcards are now properly escaped.

The CVSS score of 6.9 indicates medium severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the BaseEntityAutocompleteType endpoint is publicly exposed and does not require authentication, an attacker can perform the exploit without credentials. Successful exploitation allows the attacker to use the endpoint as a broad matcher or blind Boolean oracle, enabling data enumeration and partial disclosure. Upgrading to a patched release removes the unescaped input and eliminates the data‑exfiltration path.