The Symfony Serializer component contains an issue where the `DataUriNormalizer` only handles specific types, causing the `ObjectNormalizer` to instantiate subclasses like `UploadedFile` using attacker-controlled data via the constructor. This allows an arbitrary file on the server to be treated as an uploaded file. An attacker can send a request body containing a `path` variable to point to sensitive files, such as `.env.local`. By setting a `test` variable to `true`, the `UploadedFile::isValid()` function skips the `is uploaded file()` check, and the `move()` function reverts to `rename()`. This can lead to the exposure of any file readable by PHP, the unauthorized moving of files, or the confirmation of a file's existence on the server. The issue affects any code deserializing untrusted data into a type with such a property, including the use of `#[MapRequestPayload]` on a DTO with an `UploadedFile` property.