# CVE-2026-118515

Symfony Serializer lets attacker treat arbitrary server files as uploads

- Page: https://www.vulneraibility.com/cve/CVE-2026-118515
- CVSS: 8.4
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.58% (percentile 48.0)
- Weakness: CWE-73
- Also known as: GHSA-h38r-xrmh-cwhr
- Published: 2026-11-06

## Affected versions

- sensiolabs symfony: affected < 5.4.56; >= 6.0.0 and < 6.4.50; >= 7.0.0 and < 7.4.23; >= 8.0.0 and < 8.1.11

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated deserialization of attacker JSON/form lets attacker read any PHP-readable file, move/overwrite files, and detect paths.

## Action

Immediate action required

## Recommendation

Upgrade to patched Symfony releases and avoid deserializing untrusted payloads

## References

- [advisory] https://github.com/symfony/symfony/security/advisories/GHSA-h38r-xrmh-cwhr
- [patch] https://github.com/symfony/symfony/commit/72ece5bb3084e8233325166357f85c8c0650ee86
- [patch] https://github.com/symfony/symfony/commit/c459104eb18ebda31e112c5490970da3f30bd668

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.