File Read
Security incidents tagged File Read. Newest first.
1 File Read incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 2
- Longest quiet run: 2 days (Nov 5–Nov 6)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
Symfony Serializer: UploadedFile / data-URI denormalization can read arbitrary server files (CVE-2026-118515, CVE-2026-121623)
On Nov 4 2026 Symfony disclosed two high-impact Serializer file-read bugs fixed in symfony/serializer 5.4.56 / 6.4.50 / 7.4.23 / 8.1.11. CVE-2026-118515: when deserializing untrusted data into a DTO with an UploadedFile (or other SplFileInfo subclass) property—common with #[MapRequestPayload]—ObjectNormalizer could instantiate UploadedFile from attacker-controlled path/originalName/test fields, so the app treats any PHP-readable server file as an upload (read, move via rename when test:true, or path existence). CVE-2026-121623 (GHSA-pxj9-jh84-vhm5): DataUriNormalizer accepted case-insensitive DATA: schemes that PHP opens as relative local paths, so denormalizing to SplFileObject/File/SplFileInfo could read arbitrary files (e.g. DATA:,/../../../../etc/hostname). FrameworkBundle registers DataUriNormalizer by default. Same-day Symfony published six additional Serializer/security advisories; upgrade Serializer (or the framework release that pulls these versions) on every maintained branch.
Symfony Serializer (symfony/serializer)Since Nov 4, 2026
