Symfony DataUriNormalizer reads local files from uppercase data URIs
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
Symfony Serializer versions before 5.4.56, from 6.0.0 before 6.4.50, from 7.0.0 before 7.4.23 and from 8.0.0 before 8.1.11 are affected. The DataUriNormalizer::denormalize() method matches the data: scheme case-sensitively, so a value with an uppercase scheme is opened as a local file path instead of being decoded as inline data (CWE-22). A remote attacker can send a single crafted request to any endpoint that deserializes untrusted input into File, SplFileInfo or SplFileObject and read arbitrary local files the application can access, with no authentication if the endpoint is public.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The Symfony Serializer component DataUriNormalizer::denormalize() matches the data: scheme with a case-sensitive regular expression, allowing a value with an uppercase scheme, such as DATA:,/../../../etc/passwd, to bypass it, resulting in Arbitrary Local File Read through Path Traversal in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. A value whose scheme is not lowercase data: are treated as a local file path and opened instead of being decoded as inline data, so the resulting File, \SplFileInfo, or \SplFileObject points at a file on the server, which the application then handles as the uploaded content. Any endpoint that deserializes untrusted input into one of these types is affected. FrameworkBundle registers DataUriNormalizer ahead of ObjectNormalizer by default. A single request with a crafted DATA: value is enough to read arbitrary local files that the application can access, with no authentication needed if the endpoint is public.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
No affected products listed by the sources yet.
Remediation
Upgrade Symfony to 5.4.56, 6.4.50, 7.4.23 or 8.1.11, matching the branch in use.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
sensiolabs symfony 5.4.56, 6.4.50 and 2 more versions
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-85971 Symfony YAML parser inefficient parsing enables denial of servicePriority LOW 38
- TI-2026-85989 Symfony Serializer lets clients turn server files into uploadsPriority LOW 37
- TI-2026-86046 XML external entity injection in Symfony Config componentPriority LOW 12
Timeline
- 2026-11-06 Threatist record created from CVE-2026-121623
- 2026-11-08 Priority changed: MEDIUM → LOW
References
More sensiolabs vulnerabilities
- TI-2019-13616 An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0… CVSS 3.1CRITICAL 9.8
- TI-2018-10604 An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through… CVSS 3.1MEDIUM 6.5
- TI-2019-08131 In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and… CVSS 3.1CRITICAL 9.8
- TI-2016-02159 Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass… CVSS 3.0CRITICAL 9.8
- TI-2019-08459 An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. CVSS 3.1CRITICAL 9.8
- TI-2018-08136 An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x… CVSS 3.0CRITICAL 9.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences