Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623) · updates https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623 On Nov 4 2026 Symfony disclosed two high-impact Serializer file-read bugs fixed in symfony/serializer 5.4.56 / 6.4.50 / 7.4.23 / 8.1.11. CVE-2026-118515: when deserializing untrusted data into a DTO with an UploadedFile (or other SplFileInfo subclass) property—common with #[MapRequestPayload]—ObjectNormalizer could instantiate UploadedFile from attacker-controlled path/originalName/test fields, so the app treats any PHP-readable server file as an upload (read, move via rename when test:true, or path existence). CVE-2026-121623 (GHSA-pxj9-jh84-vhm5): DataUriNormalizer accepted case-insensitive DATA: schemes that PHP opens as relative local paths, so denormalizing to SplFileObject/File/SplFileInfo could read arbitrary files (e.g. DATA:,/../../../../etc/hostname). FrameworkBundle registers DataUriNormalizer by default. Same-day Symfony published six additional Serializer/security advisories; upgrade Serializer (or the framework release that pulls these versions) on every maintained branch. en Wed, 04 Nov 2026 00:00:00 GMT Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623): Symfony publishes CVE-2026-118515: Serializer DataUriNormalizer / ObjectNormalizer path lets clients build UploadedFile objects pointing at arbitrary server files when deserializing untrusted data (e.g. MapRequestPayload DTOs). https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623 https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623#2026-11-04-6400fb30 Wed, 04 Nov 2026 00:00:00 GMT high <p><a href="https://symfony.com/blog/cve-2026-118515-the-serializer-builds-uploadedfile-objects-from-request-data-pointing-uploads-at-any-server-file">Source</a></p> Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623): Symfony publishes GHSA-pxj9-jh84-vhm5 (CVE-2026-121623): DataUriNormalizer accepts non-lowercase DATA: schemes that PHP opens as local paths, enabling arbitrary server file reads via SplFileInfo/File/SplFileObject denormalization. https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623 https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623#2026-11-04-411961e3 Wed, 04 Nov 2026 00:00:00 GMT high <p><a href="https://symfony.com/blog/ghsa-pxj9-jh84-vhm5-dataurinormalizer-opens-data-uris-with-a-non-lowercase-scheme-as-local-files">Source</a></p> Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623): Both Serializer file-read issues fixed in symfony/serializer 5.4.56, 6.4.50, 7.4.23 and 8.1.11 as part of an eight-advisory security release day. https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623 https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623#2026-11-04-d059dfbc Wed, 04 Nov 2026 00:00:00 GMT high <p><a href="https://symfony.com/blog/cve-2026-118515-the-serializer-builds-uploadedfile-objects-from-request-data-pointing-uploads-at-any-server-file">Source</a></p>