The vulnerability in Symfony UX arises when a #[LiveProp] property typed as DateTimeInterface lacks an explicit format configuration. The LiveComponentHydrator::hydrateObjectValue() method falls back to instantiating a new DateTime object using the client-supplied string directly. This allows relative date strings to be interpreted and accepted, potentially enabling attackers to manipulate date-based logic by supplying values like 'now' or '+10 years'. The flaw affects versions >=2.8.0 <2.36.0 and >=3.0.0 <3.1.0 and has been resolved in 2.36.0 and 3.1.0.

An attacker can supply relative date strings that bypass intended time-based business logic checks, potentially leading to incorrect application behavior or logic bypass. There is no indication of privilege escalation or remote code execution. The CVSS 4.0 base score is 6.9 (medium severity), indicating a moderate impact with network attack vector and no user interaction required.

This vulnerability is fixed in Symfony UX versions 2.36.0 and 3.1.0. Users should upgrade to these versions or later to remediate the issue. No official temporary fixes or workarounds are indicated. Patch status is not explicitly stated as 'patchAvailable' but the vendor fixed the issue in these versions. Therefore, upgrading to the fixed versions is the recommended remediation.