CVE-2026-122053

The Symfony Serializer component's ObjectNormalizer is vulnerable to a property-path traversal issue in versions 5.4.41 to 5.4.55 , 6.4.9 to 6.4.49 , 7.0.9 to 7.1.0 , 7.1.2 to 7.4.22 , and 8.x prior to 8.1.11 . The vulnerability arises because ObjectNormalizer treats attribute names containing . ...

CVE-2026-118515

The Symfony Serializer component is vulnerable to an arbitrary file handling issue because the DataUriNormalizer only handles exact types (SplFileInfo, SplFileObject, and File). When a property is typed with a subclass like UploadedFile , the ObjectNormalizer instantiates it via the constructor u...

CVE-2026-118515: sensiolabs symfony: The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File,…

The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass such as UploadedFile, ObjectNormalizer instantiates the object through its constructor from attacker-controlled data, including the file...

CVE-2026-118515

"DataUriNormalizer" builds "\SplFileInfo", "\SplFileObject" and "Symfony\Component\HttpFoundation\File\File" objects from data URIs, for those exact types only. A property typed with a subclass of them, like "UploadedFile", was left to "ObjectNormalizer", which instantiated it through its...