CVE-2026-118515

The Symfony Serializer component is vulnerable to an arbitrary file handling issue because the DataUriNormalizer only handles exact types (SplFileInfo, SplFileObject, and File). When a property is typed with a subclass like UploadedFile , the ObjectNormalizer instantiates it via the constructor u...

CVE-2026-121623 Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File

The Symfony Serializer component DataUriNormalizer::denormalize matches the data: scheme with a case-sensitive regular expression, allowing a value with an uppercase scheme, such as DATA:,/../../../etc/passwd, to bypass it, resulting in Arbitrary Local File Read through Path Traversal in Symfony...

CVE-2026-121623

The Symfony Serializer component is vulnerable to Arbitrary Local File Read via Path Traversal due to a case-sensitive regular expression in DataUriNormalizer::denormalize(). Attackers can bypass scheme validation by using an uppercase scheme (e.g., DATA:) to force the application to treat a URI ...

CVE-2026-121623: sensiolabs symfony: The Symfony Serializer component DataUriNormalizer::denormalize() matches the data: scheme with a case-sensitive…

The Symfony Serializer component DataUriNormalizer::denormalize matches the data: scheme with a case-sensitive regular expression, allowing a value with an uppercase scheme, such as DATA:,/../../../etc/passwd, to bypass it, resulting in Arbitrary Local File Read through Path Traversal in Symfony...

CVE-2026-118515: sensiolabs symfony: The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File,…

The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass such as UploadedFile, ObjectNormalizer instantiates the object through its constructor from attacker-controlled data, including the file...

CVE-2021-40865

CVE-2021-40865 CVE-2021-40865 POC/exploit-poc import org.apache.commons.io.IOUtils; import org.apache.storm.serialization.KryoValuesSerializer; import ysoserial.payloads.ObjectPayload; import ysoserial.payloads.URLDNS; import java.io.; import java.math.BigInteger; import java.net.; import...

ktor-xxe-poc

CVE-2023-45612: JetBrains Ktor XXE Proof of Concept This repository contains a vulnerable Ktor server to demonstrate the XML External Entity XXE injection vulnerability identified in CVE-2023-45612. The vulnerability exists in Ktor versions before 2.3.5 when the ContentNegotiation plugin is used...

GHSA-9WX9-5PV9-3349 Seroval: Script injection through RegExp sources in serialized output

Summary seroval writes a RegExp as a regular expression literal. In affected versions, the element that the serialized output is placed in, and run script in the page. Details seroval escapes element. RegExp sources did not get the same escaping: - Versions before 1.0.0 wrote the source as is. -...

Seroval: Script injection through RegExp sources in serialized output

Summary seroval writes a RegExp as a regular expression literal. In affected versions, the element that the serialized output is placed in, and run script in the page. Details seroval escapes element. RegExp sources did not get the same escaping: - Versions before 1.0.0 wrote the source as is. -...

PHP 8.5.12 Session Upload Progress Serializer Confusion

PHP version 8.5.12 contains a session upload progress serializer confusion issue when an application changes the session serializer at runtime, allowing unauthenticated object injection and remote code execution where a suitable gadget is present. https://packetstorm.news/download/237404...

CLEANSTART-2026-VQ21617 MessagePack is the serializer implementation for Python msgpack

Security vulnerability affects the apache-superset package. MessagePack is the serializer implementation for Python msgpack...

Astra Linux – vulnerability in freerdp3

FreeRDP versions prior to 3.31.0 contain an information disclosure vulnerability in the RDPGFX server’s ResetGraphics PDU serializer. This vulnerability arises because padding bytes are not properly initialized within the fixed 340-byte wire format. Attackers can exploit this flaw by receiving...

[SECURITY] [DLA-4803-1] ruby-oj security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4803-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley September 30, 2026 https://wiki.debian.org/LTS -...

Fedora 44 : perl-Dancer2 (2026-3b893ccf2d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3b893ccf2d advisory. Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrar...

Fedora 45 : perl-Dancer2 (2026-5e3eab9a07)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5e3eab9a07 advisory. Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrar...

SUSE CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

DEBIAN-CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...