Symfony UX versions >=2.2.0 <2.36.0 and >=3.0.0 <3.1.0 contain a vulnerability in the addSearchClause() method of the EntitySearchUtil class. This method constructs SQL LIKE queries for the autocomplete endpoint by wrapping client-supplied input with % wildcards but fails to escape SQL LIKE wildcard characters such as %, _, and \. This improper sanitization enables unauthenticated attackers to leverage the public BaseEntityAutocompleteType endpoint as a broad matcher or blind boolean oracle against all columns in the default searchable_fields, leading to exposure of sensitive information. The issue is resolved in versions 2.36.0 and 3.1.0 where proper escaping or input handling is implemented.

The vulnerability allows unauthenticated attackers to query the autocomplete endpoint in a way that can reveal sensitive information from database columns that are searchable by default. This exposure occurs because the input is not properly escaped, enabling broad or blind boolean matching attacks. There is no indication of privilege escalation, denial of service, or code execution impacts. The CVSS 4.0 base score is 6.9 (medium severity) reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact.

A fix is available in Symfony UX versions 2.36.0 and 3.1.0. Users should upgrade to these versions or later to remediate this vulnerability. Since no official vendor advisory or patch link is provided, verify the fix status with the Symfony project or official repositories before upgrading. Until patched, consider restricting access to the autocomplete endpoint or implementing additional input validation and escaping to mitigate exposure.