CVE-2026-49211: Information exposure via unescaped LIKE wildcards in EntitySearchUtil (Symfony Blog)

A security advisory for CVE-2026-49211 affecting the Symfony UX Autocomplete component. The vulnerability allows unauthenticated users to exploit unescaped SQL LIKE wildcards (%, _, \) in the autocomplete endpoint's EntitySearchUtil, enabling broad data matching or blind boolean oracle attacks against entity columns. Since the endpoint is public by default and searchable_fields covers all entity properties, sensitive data can be exposed without authentication. The fix escapes wildcard characters using addcslashes() and adds an explicit ESCAPE clause. Affected versions are >=2.2.0 <2.36.0 and >=3.0.0 <3.1.0; patched in 2.36.0 and 3.1.0.