CVE-2026-121623 | SensioLabs Symfony up to 5.4.55/6.4.49/7.4.22/8.1.10 Serializer denormalize path traversal

A vulnerability was found in SensioLabs Symfony up to 5.4.55/6.4.49/7.4.22/8.1.10. It has been declared as problematic. Affected by this issue is the function DataUriNormalizer::denormalize of the component Serializer. Executing a manipulation can lead to path traversal.

The identification of this vulnerability is CVE-2026-121623. The attack may be launched remotely. There is no exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More