AIKIDO-2026-11066

TL;DR

Symfony UX Autocomplete's EntitySearchUtil::addSearchClause() builds a LIKE expression by wrapping the client-supplied query in %...% without escaping the SQL LIKE wildcards %, _, and \. Because BaseEntityAutocompleteType ships with security => false and searchable_fields defaults to every property of the entity, an unauthenticated caller can submit % to match every row or use _ as a single-character wildcard, turning the public autocomplete endpoint into a broad matcher or blind boolean oracle against entity columns the application never intended to expose. The fix escapes \, %, and _ in the user-supplied query with addcslashes() and appends an explicit ESCAPE '\' clause so those characters match literally.