# Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623) · pwn.watch

> On Nov 4 2026 Symfony disclosed two high-impact Serializer file-read bugs fixed in symfony/serializer 5.4.56 / 6.4.50 / 7.4.23 / 8.1.11. CVE-2026-118515: when deserializing untrusted data into a DTO with an UploadedFile (or other SplFileInfo subclass) property—common with #[MapRequestPayload]—ObjectNormalizer could instantiate UploadedFile from attacker-controlled path/originalName/test fields, so the app treats any PHP-readable server file as an upload (read, move via rename when test:true, or path existence). CVE-2026-121623 (GHSA-pxj9-jh84-vhm5): DataUriNormalizer accepted case-insensitive DATA: schemes that PHP opens as relative local paths, so denormalizing to SplFileObject/File/SplFileInfo could read arbitrary files (e.g. DATA:,/../../../../etc/hostname). FrameworkBundle registers DataUriNormalizer by default. Same-day Symfony published six additional Serializer/security advisories; upgrade Serializer (or the framework release that pulls these versions) on every maintained branch.

Page: https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623 · generated 2026-11-07T20:22:27.676Z

## Status
- Severity: high · status: live · patch: patched
- Product: Symfony Serializer (symfony/serializer)
- Started: 2026-11-04
- CVEs: CVE-2026-118515, CVE-2026-121623
- Affected: symfony/serializer before 5.4.56; symfony/serializer 6.0.0 before 6.4.50; symfony/serializer 7.0.0 before 7.4.23; symfony/serializer 8.0.0 before 8.1.11
- Fixed in: 5.4.56; 6.4.50; 7.4.23; 8.1.11

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623/feed.xml
- JSON Feed: https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623.json
- This file: https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623/llms.txt

## Updates (newest first)
- 2026-11-04: Symfony publishes CVE-2026-118515: Serializer DataUriNormalizer / ObjectNormalizer path lets clients build UploadedFile objects pointing at arbitrary server files when deserializing untrusted data (e.g. MapRequestPayload DTOs). (https://symfony.com/blog/cve-2026-118515-the-serializer-builds-uploadedfile-objects-from-request-data-pointing-uploads-at-any-server-file)
- 2026-11-04: Symfony publishes GHSA-pxj9-jh84-vhm5 (CVE-2026-121623): DataUriNormalizer accepts non-lowercase DATA: schemes that PHP opens as local paths, enabling arbitrary server file reads via SplFileInfo/File/SplFileObject denormalization. (https://symfony.com/blog/ghsa-pxj9-jh84-vhm5-dataurinormalizer-opens-data-uris-with-a-non-lowercase-scheme-as-local-files)
- 2026-11-04: Both Serializer file-read issues fixed in symfony/serializer 5.4.56, 6.4.50, 7.4.23 and 8.1.11 as part of an eight-advisory security release day. (https://symfony.com/blog/cve-2026-118515-the-serializer-builds-uploadedfile-objects-from-request-data-pointing-uploads-at-any-server-file)

## Fix brief
# Security brief: Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623)

Source: https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623 · status: live · severity: high · updated Nov 7, 2026, 02:30 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
On Nov 4 2026 Symfony disclosed two high-impact Serializer file-read bugs fixed in symfony/serializer 5.4.56 / 6.4.50 / 7.4.23 / 8.1.11. CVE-2026-118515: when deserializing untrusted data into a DTO with an UploadedFile (or other SplFileInfo subclass) property—common with #[MapRequestPayload]—ObjectNormalizer could instantiate UploadedFile from attacker-controlled path/originalName/test fields, so the app treats any PHP-readable server file as an upload (read, move via rename when test:true, or path existence). CVE-2026-121623 (GHSA-pxj9-jh84-vhm5): DataUriNormalizer accepted case-insensitive DATA: schemes that PHP opens as relative local paths, so denormalizing to SplFileObject/File/SplFileInfo could read arbitrary files (e.g. DATA:,/../../../../etc/hostname). FrameworkBundle registers DataUriNormalizer by default. Same-day Symfony published six additional Serializer/security advisories; upgrade Serializer (or the framework release that pulls these versions) on every maintained branch.

Severity detail: Unauthenticated/client-controlled deserialization into UploadedFile or SplFile* types can read or relocate arbitrary PHP-readable server files; fixed in maintained Serializer branches the same day as six other advisories

- Product: Symfony Serializer (symfony/serializer)
- CVE / advisory ids: CVE-2026-118515, CVE-2026-121623

## Affected versions
- symfony/serializer before 5.4.56
- symfony/serializer 6.0.0 before 6.4.50
- symfony/serializer 7.0.0 before 7.4.23
- symfony/serializer 8.0.0 before 8.1.11

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 5.4.56
- 6.4.50
- 7.4.23
- 8.1.11

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Nov 4, 2026: Symfony publishes CVE-2026-118515: Serializer DataUriNormalizer / ObjectNormalizer path lets clients build UploadedFile objects pointing at arbitrary server files when deserializing untrusted data (e.g. MapRequestPayload DTOs).
- Nov 4, 2026: Symfony publishes GHSA-pxj9-jh84-vhm5 (CVE-2026-121623): DataUriNormalizer accepts non-lowercase DATA: schemes that PHP opens as local paths, enabling arbitrary server file reads via SplFileInfo/File/SplFileObject denormalization.
- Nov 4, 2026: Both Serializer file-read issues fixed in symfony/serializer 5.4.56, 6.4.50, 7.4.23 and 8.1.11 as part of an eight-advisory security release day.

## Advisories
- [CVE-2026-118515: The Serializer Builds UploadedFile Objects From Request Data, Pointing Uploads at Any Server File](https://symfony.com/blog/cve-2026-118515-the-serializer-builds-uploadedfile-objects-from-request-data-pointing-uploads-at-any-server-file) (Symfony)
- [GHSA-pxj9-jh84-vhm5: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files](https://symfony.com/blog/ghsa-pxj9-jh84-vhm5-dataurinormalizer-opens-data-uris-with-a-non-lowercase-scheme-as-local-files) (Symfony)

## Caveats
Cite Symfony blog advisories only. Do not cite cve.now. CVE-2026-121623 maps to GHSA-pxj9-jh84-vhm5 on the Symfony blog.

---
Machine-readable: https://pwn.watch/i/symfony-serializer-uploadedfile-datauri-cve-2026-118515-121623.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.