CVE-2026-121623

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.56 Symfony versions prior to 6.4.50 Symfony versions prior to 7.4.23 Symfony versions prior to 8.1.11

Description The DataUriNormalizer::denormalize() function in the Symfony Serializer component uses a case-sensitive regular expression to match the data: scheme. This allows an attacker to use an uppercase scheme, such as DATA:, to bypass the check. Consequently, the input is treated as a local file path rather than inline data, leading to Arbitrary Local File Read through Path Traversal. This occurs when the application deserializes untrusted input into File, SplFileInfo, or SplFileObject types. Any endpoint performing this deserialization is affected, and a single request with a crafted value can read local files accessible to the application without requiring authentication if the endpoint is public.

Recommendations Update to version 5.4.56 or later. Update to version 6.4.50 or later. Update to version 7.4.23 or later. Update to version 8.1.11 or later.