Case-Sensitive Regex Vulnerability in Symfony Serializer Component

CVE-2026-121623

What is CVE-2026-121623?

The Symfony Serializer component's DataUriNormalizer::denormalize() utilizes a case-sensitive regular expression to match the data: scheme. This flaw permits an attacker to exploit an uppercase scheme such as DATA:, which allows bypassing the intended data validation. Consequently, the component treats any improperly cased data scheme as a local file path, leading to potential arbitrary file reads from the server. This vulnerability affects any endpoint that deserializes untrusted input, posing a serious threat to applications utilizing affected Symfony versions, where a single crafted request can gain access to sensitive files without requiring authentication if accessed publicly.

References