{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623) · updates",
  "home_page_url": "https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623",
  "feed_url": "https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623/feed.json",
  "description": "On Nov 4 2026 Symfony disclosed two high-impact Serializer file-read bugs fixed in symfony/serializer 5.4.56 / 6.4.50 / 7.4.23 / 8.1.11. CVE-2026-118515: when deserializing untrusted data into a DTO with an UploadedFile (or other SplFileInfo subclass) property—common with #[MapRequestPayload]—ObjectNormalizer could instantiate UploadedFile from attacker-controlled path/originalName/test fields, so the app treats any PHP-readable server file as an upload (read, move via rename when test:true, or path existence). CVE-2026-121623 (GHSA-pxj9-jh84-vhm5): DataUriNormalizer accepted case-insensitive DATA: schemes that PHP opens as relative local paths, so denormalizing to SplFileObject/File/SplFileInfo could read arbitrary files (e.g. DATA:,/../../../../etc/hostname). FrameworkBundle registers DataUriNormalizer by default. Same-day Symfony published six additional Serializer/security advisories; upgrade Serializer (or the framework release that pulls these versions) on every maintained branch.",
  "language": "en",
  "_pwn": {
    "slug": "symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623/feed.xml",
    "llms": "https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623/llms.txt",
    "json": "https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623#2026-11-04-6400fb30",
      "url": "https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623#2026-11-04-6400fb30",
      "title": "Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623): Symfony publishes CVE-2026-118515: Serializer DataUriNormalizer / ObjectNormalizer path lets clients build UploadedFile objects pointing at arbitrary server files when deserializing untrusted data (e.g. MapRequestPayload DTOs).",
      "content_text": "Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623): Symfony publishes CVE-2026-118515: Serializer DataUriNormalizer / ObjectNormalizer path lets clients build UploadedFile objects pointing at arbitrary server files when deserializing untrusted data (e.g. MapRequestPayload DTOs).\n\nSource: https://symfony.com/blog/cve-2026-118515-the-serializer-builds-uploadedfile-objects-from-request-data-pointing-uploads-at-any-server-file",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://symfony.com/blog/cve-2026-118515-the-serializer-builds-uploadedfile-objects-from-request-data-pointing-uploads-at-any-server-file",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623#2026-11-04-411961e3",
      "url": "https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623#2026-11-04-411961e3",
      "title": "Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623): Symfony publishes GHSA-pxj9-jh84-vhm5 (CVE-2026-121623): DataUriNormalizer accepts non-lowercase DATA: schemes that PHP opens as local paths, enabling arbitrary server file reads via SplFileInfo/File/SplFileObject denormalization.",
      "content_text": "Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623): Symfony publishes GHSA-pxj9-jh84-vhm5 (CVE-2026-121623): DataUriNormalizer accepts non-lowercase DATA: schemes that PHP opens as local paths, enabling arbitrary server file reads via SplFileInfo/File/SplFileObject denormalization.\n\nSource: https://symfony.com/blog/ghsa-pxj9-jh84-vhm5-dataurinormalizer-opens-data-uris-with-a-non-lowercase-scheme-as-local-files",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://symfony.com/blog/ghsa-pxj9-jh84-vhm5-dataurinormalizer-opens-data-uris-with-a-non-lowercase-scheme-as-local-files",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623#2026-11-04-d059dfbc",
      "url": "https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623#2026-11-04-d059dfbc",
      "title": "Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623): Both Serializer file-read issues fixed in symfony/serializer 5.4.56, 6.4.50, 7.4.23 and 8.1.11 as part of an eight-advisory security release day.",
      "content_text": "Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623): Both Serializer file-read issues fixed in symfony/serializer 5.4.56, 6.4.50, 7.4.23 and 8.1.11 as part of an eight-advisory security release day.\n\nSource: https://symfony.com/blog/cve-2026-118515-the-serializer-builds-uploadedfile-objects-from-request-data-pointing-uploads-at-any-server-file",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://symfony.com/blog/cve-2026-118515-the-serializer-builds-uploadedfile-objects-from-request-data-pointing-uploads-at-any-server-file",
      "tags": [
        "high"
      ]
    }
  ]
}