# CVE-2026-121623: Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File

Status: published. Published: 2026-11-06. Updated: 2026-11-06.

The Symfony Serializer component DataUriNormalizer::denormalize() matches the data: scheme with a case-sensitive regular expression, allowing a value with an uppercase scheme, such as DATA:,/../../../etc/passwd, to bypass it, resulting in Arbitrary Local File Read through Path Traversal in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.

A value whose scheme is not lowercase data: are treated as a local file path and opened instead of being decoded as inline data, so the resulting File, \SplFileInfo, or \SplFileObject points at a file on the server, which the application then handles as the uploaded content.

Any endpoint that deserializes untrusted input into one of these types is affected. FrameworkBundle registers DataUriNormalizer ahead of ObjectNormalizer by default. A single request with a crafted DATA: value is enough to read arbitrary local files that the application can access, with no authentication needed if the endpoint is public.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: Checkmarx) — https://github.com/symfony/symfony/commit/a0c551861ac23f888dfe6d1157ca78f4e220f3b7

## Affected products and versions

- sensiolabs / symfony (symfony/serializer): ≥ 0; < 5.4.56 (affected, git); ≥ 6.0.0; < 6.4.50 (affected, git); ≥ 7.0.0; < 7.4.23 (affected, git); ≥ 8.0.0; < 8.1.11 (affected, git). Source: CNA: Checkmarx

## Severity and prioritization

- CVSS 4.0: 8.2 (high); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N; source: CNA: Checkmarx

- CVSS 4.0: 8.2 (high); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: 596c5446-0ce5-4ba2-aa66-48b3b757a647

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-73, CWE-22

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/symfony/symfony/security/advisories/GHSA-pxj9-jh84-vhm5 (CNA: Checkmarx; third-party-advisory)

- https://github.com/symfony/symfony/commit/a0c551861ac23f888dfe6d1157ca78f4e220f3b7 (CNA: Checkmarx; patch)

- https://github.com/symfony/symfony/commit/a0c551861ac23f888dfe6d1157ca78f4e220f3b7 (596c5446-0ce5-4ba2-aa66-48b3b757a647)

- https://github.com/symfony/symfony/security/advisories/GHSA-pxj9-jh84-vhm5 (596c5446-0ce5-4ba2-aa66-48b3b757a647)

## Provenance

- CNA: Checkmarx: https://www.cve.org/CVERecord?id=CVE-2026-121623; retrieved 2026-11-06; source updated 2026-11-06

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-121623; retrieved 2026-11-07; source updated 2026-11-06

Revision: ed0877d354062b1057d3432e54a972fc2347f5561a987a446752664be885625d

Canonical: https://y2.dev/cve/CVE-2026-121623

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.