File Upload Vulnerability in Symfony Framework

CVE-2018-19789

What is CVE-2018-19789?

A file upload vulnerability exists in the Symfony Framework, where inappropriate handling of uploaded files can lead to the disclosure of their full path. This issue arises when a setter method using the scalar type hint 'string' is employed in a form data class. If a file is submitted instead of the expected text input, the UploadedFile::__toString() method can expose sensitive information, subsequently opening the door to potential remote code execution when combined with a local file inclusion vulnerability.

References