CVE-2026-118515

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.56 Symfony versions 6.x prior to 6.4.50 Symfony versions 7.x prior to 7.4.23 Symfony versions 8.x prior to 8.1.11

Description The Symfony Serializer component contains an issue where the DataUriNormalizer only handles specific types, causing the ObjectNormalizer to instantiate subclasses like UploadedFile using attacker-controlled data via the constructor. This allows an arbitrary file on the server to be treated as an uploaded file. An attacker can send a request body containing a path variable to point to sensitive files, such as .env.local. By setting a test variable to true, the UploadedFile::isValid() function skips the is uploaded file() check, and the move() function reverts to rename(). This can lead to the exposure of any file readable by PHP, the unauthorized moving of files, or the confirmation of a file's existence on the server. The issue affects any code deserializing untrusted data into a type with such a property, including the use of #[MapRequestPayload] on a DTO with an UploadedFile property.

Recommendations Update Symfony to version 5.4.56 or later. Update Symfony to version 6.4.50 or later. Update Symfony to version 7.4.23 or later. Update Symfony to version 8.1.11 or later.