Symfony Serializer builds uploads from arbitrary server files
Symfony, a PHP web tool, lets outsiders peek at server files.
Summary
The Symfony Serializer component turns a client-supplied server file path into an UploadedFile-like object when the property is a subclass. Applications that deserialize untrusted data into such a type are affected in Symfony versions before 5.4.56, 6.4.50, 7.4.23 and 8.1.11.
Affected when
- Deserializing untrusted data into a type with an UploadedFile-like property (e.g., a #[MapRequestPayload] DTO)
- A serializer built without DataUriNormalizer ahead of the object normalizer
What to do
Update to Symfony 5.4.56, 6.4.50, 7.4.23 or 8.1.11 for your branch. Check that your version is newer than the fixed version for its line, and read the advisory.
Update to at least the version for your product:
- Symfony 5.4 5.4.56 or later
- Symfony 6.4 6.4.50 or later
- Symfony 7.4 7.4.23 or later
- Symfony 8.1 8.1.11 or later
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen