CLEANSTART-2026-HO34252: Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass such as UploadedFile, ObjectNormalizer inst...
Security vulnerability affects the drupal package. The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass such as UploadedFile, ObjectNormalizer instantiates the object through its constructor from attacker-controlled data, including the file path.
Affected Software
Frequently Asked Questions
What application behavior makes this issue exploitable?
A property must be typed with a subclass of SplFileInfo, SplFileObject, or File, such as UploadedFile, and be processed by Symfony Serializer's ObjectNormalizer. Attacker-controlled input can then be used to invoke the object's constructor, including its file-path argument.
Is this limited to the exact file-related types handled by DataUriNormalizer?
The issue arises for subclass-typed properties because DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File. Those subclasses can instead be instantiated by ObjectNormalizer from attacker-controlled data.