Symfony's PdoAdapter::doClear() method builds a DELETE SQL statement using a namespace derived from a caller-supplied $prefix parameter without proper binding or escaping. This allows an attacker who can control $prefix to break out of the LIKE literal in the SQL query, potentially altering the semantics of the query or expanding the scope of deletions. The vulnerability affects versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12 and is resolved in these fixed versions.

An attacker able to influence the $prefix parameter can manipulate the SQL DELETE statement executed by the application, potentially causing unintended deletions or modification of query behavior. This could lead to data loss or corruption depending on the application's use of this function. There are no known exploits in the wild at this time.

Upgrade Symfony to version 5.4.52, 6.4.40, 7.4.12, or 8.0.12 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated by the vendor advisory.