CVE-2026-121623

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-121623
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-121623.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-121623
Aliases
  • GHSA-pxj9-jh84-vhm5
Downstream
Published
2026-11-06T16:08:32Z
Modified
2026-11-08T02:47:28Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File
Details

The Symfony Serializer component DataUriNormalizer::denormalize() matches the data: scheme with a case-sensitive regular expression, allowing a value with an uppercase scheme, such as DATA:,/../../../etc/passwd, to bypass it, resulting in Arbitrary Local File Read through Path Traversal in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.

A value whose scheme is not lowercase data: are treated as a local file path and opened instead of being decoded as inline data, so the resulting File, \SplFileInfo, or \SplFileObject points at a file on the server, which the application then handles as the uploaded content.

Any endpoint that deserializes untrusted input into one of these types is affected. FrameworkBundle registers DataUriNormalizer ahead of ObjectNormalizer by default. A single request with a crafted DATA: value is enough to read arbitrary local files that the application can access, with no authentication needed if the endpoint is public.

Database specific 
{
    "cna_assigner": "Checkmarx",
    "cwe_ids": [
        "CWE-22",
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121623.json"
}
References

Affected packages

Git / github.com/symfony/serializer

Affected ranges

Type
GIT
Repo
https://github.com/symfony/serializer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ffaeb561f97bb0045f1f9720a5224607816a75ee
Introduced
110e9858c0f2d69ab98a0b6d66fda7683b4ad7e6
Fixed
665e460894db3b8650c2ff79a7a1c10d09edd39a
Introduced
73f72b15e258c73685cb1b78981a870084255c23
Fixed
9df8eb88c4d067d7aef1f3940075521769f34086
Introduced
f37bc903a6676900f67c9803f0827718028cf0a8
Fixed
05624c94507c3acf065b6486bb626f0d741af459
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "5.4.56"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.4.50"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.4.23"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "fixed": "8.1.11"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}
Type
GIT
Repo
https://github.com/symfony/symfony
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d44b243381597fdc2830d1e6a878fda10293b49b
Fixed
8d8b1b074c4aa6489a4fedac2ae0af4d0268e9c3
Introduced
2ae542748a8065aba925b44b99755010dbf12ac9
Fixed
b655baf04a3727b85d4a2fa7e85aa46c5c9c8e05
Introduced
85778caba16ad6830fdc28eaa6ee8c1e91d009ef
Fixed
eca3b7b6bd3af91752b3f4b36959520d409ee279
Fixed
a0c551861ac23f888dfe6d1157ca78f4e220f3b7
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "5.4.56"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "range": [
                {
                    "introduced": "7.x"
                },
                {
                    "fixed": "7.4.23"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "range": [
                {
                    "introduced": "6.x"
                },
                {
                    "fixed": "6.4.50"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "range": [
                {
                    "introduced": "8.x"
                },
                {
                    "fixed": "8.1.11"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "range": [
                {
                    "fixed": "a0c551861ac23f888dfe6d1157ca78f4e220f3b7"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.0-RC1
v2.0.0-RC2
v2.0.0-RC3
v2.0.0-RC4
v2.0.0-RC5
v2.0.0-RC6
v2.0.0BETA1
v2.0.0BETA2
v2.0.0BETA3
v2.0.0BETA4
v2.0.0BETA5
v2.0.0PR8
v2.0.1
v2.0.4
v2.1.0
v2.1.0-BETA1
v2.1.0-BETA2
v2.1.0-BETA3
v2.1.0-BETA4
v2.1.0-RC1
v2.1.0-RC2
v2.1.1
v2.1.2
v2.2.0
v2.2.0-BETA1
v2.2.0-BETA2
v2.3.0
v2.3.0-BETA1
v2.3.0-BETA2
v2.3.1
v2.4.0-BETA1
v2.4.0-BETA2
v2.4.0-RC1
v2.5.0
v2.5.0-BETA1
v2.5.0-BETA2
v2.5.0-RC1
v2.6.0-BETA1
v3.*
v3.0.0
v3.0.0-BETA1
v3.1.0-BETA1
v3.2.0-BETA1
v3.2.0-RC1
v3.2.0-RC2
v3.3.0-BETA1
v3.3.0-RC1
v4.*
v4.0.0-BETA1
v4.0.0-BETA2
v4.0.0-BETA3
v4.0.0-BETA4
v4.0.0-RC1
v4.0.0-RC2
v4.1.0-BETA1
v4.2.0
v4.2.0-BETA1
v4.2.0-BETA2
v4.2.0-RC1
v4.3.0-BETA1
v5.*
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.1.0-BETA1
v5.1.0-RC1
v5.2.0
v5.2.0-BETA1
v5.2.0-BETA2
v5.2.0-BETA3
v5.2.0-RC1
v5.2.0-RC2
v5.2.1
v5.3.0-BETA1
v5.3.0-BETA2
v5.3.0-BETA3
v5.3.0-BETA4
v5.3.0-RC1
v5.4.0
v5.4.0-BETA1
v5.4.0-BETA2
v5.4.0-BETA3
v5.4.0-RC1
v5.4.1
v5.4.10
v5.4.11
v5.4.12
v5.4.13
v5.4.14
v5.4.15
v5.4.16
v5.4.17
v5.4.18
v5.4.19
v5.4.2
v5.4.20
v5.4.21
v5.4.22
v5.4.23
v5.4.24
v5.4.25
v5.4.26
v5.4.27
v5.4.28
v5.4.29
v5.4.3
v5.4.30
v5.4.31
v5.4.32
v5.4.33
v5.4.34
v5.4.35
v5.4.36
v5.4.37
v5.4.38
v5.4.39
v5.4.4
v5.4.40
v5.4.41
v5.4.42
v5.4.43
v5.4.44
v5.4.45
v5.4.46
v5.4.47
v5.4.48
v5.4.49
v5.4.5
v5.4.50
v5.4.51
v5.4.52
v5.4.53
v5.4.54
v5.4.55
v5.4.6
v5.4.7
v5.4.8
v5.4.9
v6.*
v6.0.0
v6.0.0-BETA1
v6.0.0-BETA2
v6.0.0-BETA3
v6.0.0-RC1
v6.0.1
v6.1.0
v6.1.0-BETA1
v6.1.0-BETA2
v6.1.0-RC1
v6.2.0
v6.2.0-BETA1
v6.2.0-BETA2
v6.2.0-BETA3
v6.2.0-RC1
v6.3.0-BETA1
v6.3.0-BETA2
v6.3.0-BETA3
v6.3.0-RC1
v6.4.0
v6.4.0-BETA1
v6.4.0-BETA2
v6.4.0-BETA3
v6.4.0-RC1
v6.4.0-RC2
v6.4.1
v6.4.10
v6.4.11
v6.4.12
v6.4.13
v6.4.14
v6.4.15
v6.4.16
v6.4.17
v6.4.18
v6.4.19
v6.4.2
v6.4.20
v6.4.21
v6.4.22
v6.4.23
v6.4.24
v6.4.25
v6.4.26
v6.4.27
v6.4.28
v6.4.29
v6.4.3
v6.4.30
v6.4.31
v6.4.32
v6.4.33
v6.4.34
v6.4.35
v6.4.36
v6.4.37
v6.4.38
v6.4.39
v6.4.4
v6.4.40
v6.4.41
v6.4.42
v6.4.43
v6.4.44
v6.4.45
v6.4.46
v6.4.47
v6.4.48
v6.4.49
v6.4.5
v6.4.6
v6.4.7
v6.4.8
v6.4.9
v7.*
v7.0.0-BETA1
v7.0.0-BETA2
v7.0.0-BETA3
v7.0.0-RC1
v7.0.0-RC2
v7.1.0
v7.1.0-BETA1
v7.1.0-RC1
v7.1.1
v7.2.0
v7.2.0-BETA1
v7.2.0-BETA2
v7.2.0-RC1
v7.3.0
v7.3.0-BETA1
v7.3.0-BETA2
v7.3.0-RC1
v7.4.0
v7.4.0-BETA1
v7.4.0-BETA2
v7.4.0-RC1
v7.4.0-RC2
v7.4.0-RC3
v7.4.1
v7.4.10
v7.4.11
v7.4.12
v7.4.13
v7.4.14
v7.4.15
v7.4.16
v7.4.17
v7.4.18
v7.4.19
v7.4.2
v7.4.20
v7.4.21
v7.4.22
v7.4.3
v7.4.4
v7.4.5
v7.4.6
v7.4.7
v7.4.8
v7.4.9
v8.*
v8.0.0
v8.0.0-BETA1
v8.0.0-BETA2
v8.0.0-RC1
v8.0.0-RC3
v8.0.2
v8.0.5
v8.1.0
v8.1.0-BETA1
v8.1.0-BETA2
v8.1.0-BETA3
v8.1.0-RC1
v8.1.1
v8.1.10
v8.1.2
v8.1.3
v8.1.4
v8.1.5
v8.1.6
v8.1.7
v8.1.8
v8.1.9
Other
vPR8
vPR9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-121623.json"