File Upload Vulnerability in Symfony Framework

CVE-2026-118515

What is CVE-2026-118515?

The Symfony Framework contains a deserialization vulnerability in the Serializer component's DataUriNormalizer. This flaw allows for arbitrary file handling where attacker-controlled data can be manipulated to treat any file on the server as an upload, including sensitive configuration files. This occurs when properties are typed with subclasses like UploadedFile, and the framework unconditionally processes paths specified in malicious requests. As a result, an attacker can exploit this by sending crafted JSON bodies that bypass standard file validation checks, leading to potential exposure of sensitive files or unauthorized file manipulations.

References