CVE-2026-49208: 
PHP vulnerability analysis and mitigation

CVE-2026-49208 is an improper input validation vulnerability in Symfony UX LiveComponent that allows unauthenticated attackers to manipulate DateTimeInterface-typed #[LiveProp] properties using permissive relative date strings. When no explicit date format is configured, LiveComponentHydrator::hydrateObjectValue() falls back to new $className($value), which accepts PHP relative time strings such as "now", "tomorrow", or "+10 years". This affects symfony/ux-live-component versions >=2.8.0 and <2.36.0, and >=3.0.0 and <3.1.0. The vulnerability was published on May 29, 2026, and has a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Symfony Advisory, GitHub Advisory).

The root cause is improper input validation (CWE-20) in LiveComponentHydrator::hydrateObjectValue() within the symfony/ux-live-component package. When a #[LiveProp] is typed as DateTimeInterface without an explicit format attribute, the hydrator previously fell back to new $className($value) — invoking the permissive PHP DateTime/DateTimeImmutable constructor, which accepts relative time strings in addition to absolute dates. An unauthenticated attacker can craft a frontend payload containing strings like "+10 years" or "tomorrow" and submit them via the LiveComponent update mechanism over the network, requiring no privileges or user interaction. The fix replaces the permissive constructor call with createFromFormat(DateTimeInterface::RFC3339, ...), strictly enforcing the same format already used by dehydrateObjectValue(), so only valid RFC 3339 strings are accepted (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to set writable, format-less DateTimeInterface LiveComponent properties to arbitrary points in time, potentially bypassing time-based business logic checks (e.g., expiration gates, scheduling constraints, or access windows). The impact is limited to integrity — there is no confidentiality or availability impact — but components that rely on date props to enforce business rules (such as trial periods, event registration deadlines, or time-locked features) could be circumvented. The attack is network-accessible, requires no privileges, and is automatable (GitHub Advisory, Feedly).

1. Reconnaissance: Identify web applications built with Symfony UX LiveComponent (versions >=2.8.0, <2.36.0 or >=3.0.0, <3.1.0) by inspecting HTTP responses for Symfony-specific headers, JavaScript assets referencing @symfony/ux-live-component, or Twig component markup.
2. Identify target LiveProps: Browse the application to find components that use DateTimeInterface-typed #[LiveProp(writable: true)] properties without an explicit format attribute. These are typically exposed via AJAX requests to LiveComponent update endpoints.
3. Intercept a legitimate request: Use a browser proxy (e.g., Burp Suite) to capture a legitimate LiveComponent update request, observing the JSON payload structure and the date field being sent (e.g., {"createdAt": "2024-04-05T10:00:00+00:00"}).
4. Craft a malicious payload: Replace the date field value with a PHP relative date string such as "+10 years", "tomorrow", or "now" (e.g., {"createdAt": "+10 years"}).
5. Submit the payload: Send the modified request to the LiveComponent update endpoint. On vulnerable versions, the server will parse the relative string via the permissive DateTime constructor and set the prop to the computed future/past date.
6. Bypass business logic: With the date prop now set to an attacker-controlled value, any server-side time-based checks relying on that prop (e.g., if ($this->expiresAt > new DateTime())) may be bypassed, granting unauthorized access or capabilities (GitHub Advisory, Patch Commit).

• Network: Unusual LiveComponent AJAX update requests containing non-RFC 3339 date strings (e.g., "+10 years", "tomorrow", "now", "next month") in JSON payloads sent to LiveComponent endpoints (typically POST requests to routes handled by LiveComponentSubscriber).
• Logs: Symfony application logs showing BadRequestHttpException errors referencing "invalid date data" after patching (indicating blocked exploitation attempts); on unpatched systems, absence of such errors despite unusual date values being processed.
• Application Behavior: Unexpected activation of time-gated features, bypassed expiration checks, or anomalous scheduling behavior that correlates with specific user sessions or IP addresses submitting LiveComponent updates.

Upgrade symfony/ux-live-component to version 2.36.0 (for the 2.x branch) or 3.1.0 (for the 3.x branch), which enforce strict RFC 3339 parsing for format-less DateTimeInterface LiveProps (GitHub Release v2.36.0, GitHub Release v3.1.0). As a workaround prior to upgrading, explicitly configure a format attribute on all #[LiveProp] properties typed as DateTimeInterface (e.g., #[LiveProp(writable: true, format: DateTimeInterface::RFC3339)]), which already enforced strict parsing in the old code path. Additionally, implement server-side validation of date inputs to ensure they fall within expected business logic ranges (GitHub Advisory).

The vulnerability was reported by Pascal Cescon (GitHub: Amoifr) and fixed by Hugo Alliaume (GitHub: Kocal), with the advisory published by nicolas-grekas on May 29, 2026 (GitHub Advisory). A Reddit thread in r/symfony discussed the CVE shortly after disclosure, reflecting community awareness among Symfony developers (Reddit). The fix was bundled alongside several other security patches in the v2.36.0 and v3.1.0 releases, suggesting a coordinated security release cycle by the Symfony UX team (GitHub Release v2.36.0).