# CVE-2026-121623

Symfony Serializer allows unauthenticated arbitrary local file read via DATA: scheme bypass

- Page: https://www.vulneraibility.com/cve/CVE-2026-121623
- CVSS: 8.2
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.59% (percentile 48.4)
- Weakness: CWE-73, CWE-22
- Also known as: GHSA-pxj9-jh84-vhm5
- Published: 2026-11-06

## Affected versions

- sensiolabs symfony: affected < 5.4.56; >= 6.0.0 and < 6.4.50; >= 7.0.0 and < 7.4.23; >= 8.0.0 and < 8.1.11

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated path-traversal: crafted DATA: scheme is treated as a local path, allowing attackers to read any file the app can access (e.g., /etc/passwd).

## Action

Immediate action required

## Recommendation

Upgrade to 5.4.56+/6.4.50+/7.4.23+/8.1.11+; block or validate DATA: inputs until patched

## References

- [advisory] https://github.com/symfony/symfony/security/advisories/GHSA-pxj9-jh84-vhm5
- [patch] https://github.com/symfony/symfony/commit/a0c551861ac23f888dfe6d1157ca78f4e220f3b7

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.