CVE-2026-118515

Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File

View on CVE.org

Published Nov 6, 2026 CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Description

The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass such as UploadedFile, ObjectNormalizer instantiates the object through its constructor from attacker-controlled data, including the file path. This allows an arbitrary file on the server to be treated as an uploaded file in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.

A request body such as {"image": {"path": "/path/to/project/.env.local", "originalName": "a.png", "test": true}} makes the application handle any file on the server as an upload, without the file being sent. With test: true, UploadedFile::isValid() skips is_uploaded_file() and move() falls back to rename(). Assert\File does not prevent this because it validates the file at the attacker-chosen path, which exists on the server.
Any code that deserializes untrusted data into a type that holds such a property is affected. That includes #[MapRequestPayload] on a DTO with an UploadedFile property, which is how uploads are mapped in Symfony 8.1; a single unauthenticated request with a JSON or form body is enough. Depending on what the application does with the upload, this can expose any file readable by PHP (for instance, when uploads are stored and served back), move any such file when move() is called, and reveal whether a path exists.

A serializer built without DataUriNormalizer ahead of the object normalizer is not protected by the fix; the serializer configured by FrameworkBundle is.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

sensiolabs

symfony

unaffected

Version	Status	Constraints
`0`	affected	< 5.4.56
`6.0.0`	affected	< 6.4.50
`7.0.0`	affected	< 7.4.23
`8.0.0`	affected	< 8.1.11

No data.

Vendor Product Versions

Sensiolabs

Symfony

Version	Status	Scheme	Platform
`[0,5.4.56)`	affected	generic	—
`[6.0.0,6.4.50)`	affected	semver	—
`[7.0.0,7.4.23)`	affected	semver	—
`[8.0.0,8.1.11)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.581% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/symfony/symfony/commit/72ece5bb3084e8233325166357f85c8c0650ee86
https://github.com/symfony/symfony/commit/c459104eb18ebda31e112c5490970da3f30bd668
https://github.com/symfony/symfony/security/advisories/GHSA-h38r-xrmh-cwhr

History

Nov 12, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Nov 6, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass such as UploadedFile, ObjectNormalizer instantiates the object through its constructor from attacker-controlled data, including the file path. This allows an arbitrary file on the server to be treated as an uploaded file in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. A request body such as {"image": {"path": "/path/to/project/.env.local", "originalName": "a.png", "test": true}} makes the application handle any file on the server as an upload, without the file being sent. With test: true, UploadedFile::isValid() skips is_uploaded_file() and move() falls back to rename(). Assert\File does not prevent this because it validates the file at the attacker-chosen path, which exists on the server. Any code that deserializes untrusted data into a type that holds such a property is affected. That includes #[MapRequestPayload] on a DTO with an UploadedFile property, which is how uploads are mapped in Symfony 8.1; a single unauthenticated request with a JSON or form body is enough. Depending on what the application does with the upload, this can expose any file readable by PHP (for instance, when uploads are stored and served back), move any such file when move() is called, and reveal whether a path exists. A serializer built without DataUriNormalizer ahead of the object normalizer is not protected by the fix; the serializer configured by FrameworkBundle is.
Title		Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File
First Time appeared		Sensiolabs Sensiolabs symfony
Weaknesses		CWE-73
CPEs		cpe:2.3:a:sensiolabs:symfony::::::::
Vendors & Products		Sensiolabs Sensiolabs symfony
References		https://github.com/symfony/symfony/commit/72ece5bb3084e8233325166357f85c8c0650ee86 https://github.com/symfony/symfony/commit/c459104eb18ebda31e112c5490970da3f30bd668 https://github.com/symfony/symfony/security/advisories/GHSA-h38r-xrmh-cwhr
Metrics		cvssV4_0 `{'score': 8.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N'}`