Symfony Serializer: local file read via DataUriNormalizer (CVE-2026-121623)
In the Symfony Serializer component, DataUriNormalizer::denormalize() matches the data: scheme with a case-sensitive regular expression. A value such as DATA:,/../../../etc/passwd is treated as a local file path and opened as a file. The issue is rated CVSS 8.2.
Checked in Shield: no
Who is affected
Symfony before 5.4.56, 6.x before 6.4.50, 7.x before 7.4.23, 8.x before 8.1.11. Endpoints that deserialize untrusted input into File, \SplFileInfo or \SplFileObject are affected, with no authentication needed if the endpoint is public.
How to check
Run composer show symfony/serializer and compare the version with the fixed ones. Then find endpoints that deserialize user input into File, \SplFileInfo or \SplFileObject.
How to fix
Update Symfony to 5.4.56, 6.4.50, 7.4.23 or 8.1.11, depending on your branch. After updating, review the endpoints that accept such input.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether it is exploited in the wild is not disclosed yet. Source: NVD, CVE-2026-121623.
