CVE-2026-118515

The Symfony Serializer component is vulnerable to an arbitrary file handling issue because the DataUriNormalizer only handles exact types (SplFileInfo, SplFileObject, and File). When a property is typed with a subclass like UploadedFile , the ObjectNormalizer instantiates it via the constructor u...

CVE-2026-121623 Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File

The Symfony Serializer component DataUriNormalizer::denormalize matches the data: scheme with a case-sensitive regular expression, allowing a value with an uppercase scheme, such as DATA:,/../../../etc/passwd, to bypass it, resulting in Arbitrary Local File Read through Path Traversal in Symfony...

CVE-2026-121623

The Symfony Serializer component is vulnerable to Arbitrary Local File Read via Path Traversal due to a case-sensitive regular expression in DataUriNormalizer::denormalize(). Attackers can bypass scheme validation by using an uppercase scheme (e.g., DATA:) to force the application to treat a URI ...

CVE-2026-121623: sensiolabs symfony: The Symfony Serializer component DataUriNormalizer::denormalize() matches the data: scheme with a case-sensitive…

The Symfony Serializer component DataUriNormalizer::denormalize matches the data: scheme with a case-sensitive regular expression, allowing a value with an uppercase scheme, such as DATA:,/../../../etc/passwd, to bypass it, resulting in Arbitrary Local File Read through Path Traversal in Symfony...

CVE-2026-118515: sensiolabs symfony: The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File,…

The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass such as UploadedFile, ObjectNormalizer instantiates the object through its constructor from attacker-controlled data, including the file...

CVE-2026-118515

"DataUriNormalizer" builds "\SplFileInfo", "\SplFileObject" and "Symfony\Component\HttpFoundation\File\File" objects from data URIs, for those exact types only. A property typed with a subclass of them, like "UploadedFile", was left to "ObjectNormalizer", which instantiated it through its...