CVE-2026-118515

The Symfony Serializer component is vulnerable to an arbitrary file handling issue because the DataUriNormalizer only handles exact types (SplFileInfo, SplFileObject, and File). When a property is typed with a subclass like UploadedFile , the ObjectNormalizer instantiates it via the constructor u...