CVE-2026-118515— Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File

Quick assessment

Affected

sensiolabs symfony

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Symfony Serializer 组件中的仅处理、和这三种确切类型。因此，当某个属性的类型被声明为子类（例如）时，会利用攻击者控制的数据（包括文件路径）通过构造函数实例化该对象。这导致在以下版本的 Symfony 中，服务器上的任意文件均可被当作上传文件处理： 5.4 系列：早于 5.4.56 6.x 系列：早于 6.4.50 7.x 系列：早于 7.4.23 8.x 系列：早于 8.1.11 例如，包含如下内容的请求体：会使应用程序将服务器上的任意文件视为上传文件，而无需实际发送该文件。当设置

CVSS 8.4 · High Updated Nov 07, 2026

Possible ATT&CK Techniques 3 AI

T1059 · Command and Scripting Interpreter T1083 · File and Directory Discovery T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File

Source: CVE Program / CVE List V5

Vulnerability Description

The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass such as UploadedFile, ObjectNormalizer instantiates the object through its constructor from attacker-controlled data, including the file path. This allows an arbitrary file on the server to be treated as an uploaded file in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. A request body such as {"image": {"path": "/path/to/project/.env.local", "originalName": "a.png", "test": true}} makes the application handle any file on the server as an upload, without the file being sent. With test: true, UploadedFile::isValid() skips is_uploaded_file() and move() falls back to rename(). Assert\File does not prevent this because it validates the file at the attacker-chosen path, which exists on the server. Any code that deserializes untrusted data into a type that holds such a property is affected. That includes #[MapRequestPayload] on a DTO with an UploadedFile property, which is how uploads are mapped in Symfony 8.1; a single unauthenticated request with a JSON or form body is enough. Depending on what the application does with the upload, this can expose any file readable by PHP (for instance, when uploads are stored and served back), move any such file when move() is called, and reveal whether a path exists. A serializer built without DataUriNormalizer ahead of the object normalizer is not protected by the fix; the serializer configured by FrameworkBundle is.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

文件名或路径的外部可控制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
sensiolabs	symfony	0 ~ 5.4.56	-

II. Public POCs for CVE-2026-118515

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118515

请登录查看更多情报信息。

Other References for CVE-2026-118515 (3)

https://www.cve.org/CVERecord?id=CVE-2026-118515

Same Patch Batch · sensiolabs · 2026-11-06 · 7 CVEs total

CVE-2026-123792	8.7 HIGH	Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Ho
CVE-2026-121623	8.2 HIGH	Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Let
CVE-2026-122053	6.9 MEDIUM	Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested
CVE-2026-123746	2.3 LOW	Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers
CVE-2026-123339	2.3 LOW	Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of
CVE-2026-123824	2.3 LOW	Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true

IV. Related Vulnerabilities

Same product: symfony

Same vendor: sensiolabs

Same weakness: CWE-73