CVE-2026-118515

What it is

The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass such as UploadedFile, ObjectNormalizer instantiates the object through its constructor from attacker-controlled data, including the file path. This allows an arbitrary file on the server to be treated as an uploaded file in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. A request body such as {"image": {"path": "/path/to/project/.env.local", "originalName": "a.png", "test": true}} makes the application handle any file on the server as an upload, without the file being sent. With test: true, UploadedFile::isValid() skips is_uploaded_file() and move() falls back to rename(). Assert\File does not prevent this because it validates the file at the attacker-chosen path, which exists on the server. Any code that deserializes untrusted data into a type that holds such a property is affected. That includes #[MapRequestPayload] on a DTO with an UploadedFile property, which is how uploads are mapped in Symfony 8.1; a single unauthenticated request with a JSON or form body is enough. Depending on what the application does with the upload, this can expose any file readable by PHP (for instance, when uploads are stored and served back), move any such file when move() is called, and reveal whether a path exists. A serializer built without DataUriNormalizer ahead of the object normalizer is not protected by the fix; the serializer configured by FrameworkBundle is.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data exposure, service disruption.

Exploit odds

0.6% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-10-28 14:33 UTC ReservedThe CVE id was reserved by its CNA
2. 2026-11-06 17:17 UTC PublishedDisclosed publicly on CVE.org and NVD
3. 2026-11-06 21:40 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: 0.6% in the next 30 days (EPSS).
• Severity: 8.4 HIGH (CVSS).
• Fix: a patch or advisory is linked.

Details

Published

2026-11-06 17:17 UTC

Last modified

2026-11-06 21:40 UTC

Exploit probability

0.6% · EPSS, next 30 days

Weakness

CWE-73

Record status

Awaiting Analysis

Attack profile CVSS 4.0 · 8.4

Attack vector

Network

Complexity

Low

Attack requirements

Present

Privileges needed

None

User interaction

None

Confidentiality

High

Integrity

Low

Availability

High

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2026-118515.md and follow it. Check whether this project is affected by CVE-2026-118515. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge