Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

symfony/serializer

4 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 high, 2 medium
Registry
Packagist

Advisories 4

  • CVE-2026-122053Medium 6.9

    Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects

    Affected: from 5.4.41, fixed in 5.4.56; from 6.4.9, fixed in 6.4.50; from 7.0.9, fixed in 7.1.0; from 7.1.2, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11.

  • Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File

    Affected: fixed in 5.4.56; from 6.0.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11.

  • Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File

    Affected: fixed in 5.4.56; from 6.0.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11.

  • CVE-2021-41270Medium 6.5

    CSV Injection in Symfony

    Affected: from 5.0.0, fixed in 5.3.12; from 4.1.0, fixed in 4.4.35.