Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623)
Symfony Serializer (symfony/serializer)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
On Nov 4 2026 Symfony disclosed two high-impact Serializer file-read bugs fixed in symfony/serializer 5.4.56 / 6.4.50 / 7.4.23 / 8.1.11. CVE-2026-118515: when deserializing untrusted data into a DTO with an UploadedFile (or other SplFileInfo subclass) property—common with #[MapRequestPayload]—ObjectNormalizer could instantiate UploadedFile from attacker-controlled path/originalName/test fields, so the app treats any PHP-readable server file as an upload (read, move via rename when test:true, or path existence). CVE-2026-121623 (GHSA-pxj9-jh84-vhm5): DataUriNormalizer accepted case-insensitive DATA: schemes that PHP opens as relative local paths, so denormalizing to SplFileObject/File/SplFileInfo could read arbitrary files (e.g. DATA:,/../../../../etc/hostname). FrameworkBundle registers DataUriNormalizer by default. Same-day Symfony published six additional Serializer/security advisories; upgrade Serializer (or the framework release that pulls these versions) on every maintained branch.
Why this severity: Unauthenticated/client-controlled deserialization into UploadedFile or SplFile* types can read or relocate arbitrary PHP-readable server files; fixed in maintained Serializer branches the same day as six other advisories
- Started
- Nov 4, 2026
Affected
- symfony/serializer before 5.4.56
- symfony/serializer 6.0.0 before 6.4.50
- symfony/serializer 7.0.0 before 7.4.23
- symfony/serializer 8.0.0 before 8.1.11
Fixed in
- 5.4.56
- 6.4.50
- 7.4.23
- 8.1.11
Timeline3
Symfony publishes CVE-2026-118515: Serializer DataUriNormalizer / ObjectNormalizer path lets clients build UploadedFile objects pointing at arbitrary server files when deserializing untrusted data (e.g. MapRequestPayload DTOs).
Symfony publishes GHSA-pxj9-jh84-vhm5 (CVE-2026-121623): DataUriNormalizer accepts non-lowercase DATA: schemes that PHP opens as local paths, enabling arbitrary server file reads via SplFileInfo/File/SplFileObject denormalization.
Both Serializer file-read issues fixed in symfony/serializer 5.4.56, 6.4.50, 7.4.23 and 8.1.11 as part of an eight-advisory security release day.
Advisories2
Notes & caveats
Cite Symfony blog advisories only. Do not cite cve.now. CVE-2026-121623 maps to GHSA-pxj9-jh84-vhm5 on the Symfony blog.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
