The Symfony Serializer component's DataUriNormalizer::denormalize method incorrectly treats data URIs with non‑lowercase DATA: schemes as local file paths. This flaw allows a crafted link like DATA:,/../../../../etc/passwd to bypass the intended check and open arbitrary files on the server. An attacker can obtain the contents of any file readable by the application, leading to confidentiality loss. The weakness is a file‑path traversal combined with improper parsing of data URIs (CWE‑22, CWE‑73).

The vulnerability affects the Symfony framework, specifically the Symfony Serializer component. Any Symfony installation prior to version 5.4.56, 6.4.50, 7.4.23, or 8.1.11 is impacted. SensioLabs’ Symfony product is the sole vendor and the affected components are any deserialization endpoints that involve DataUriNormalizer, which is registered by default in the FrameworkBundle.

With a CVSS score of 8.2 the flaw is considered high severity, and although EPSS is not shown, the lack of authentication requirement on public endpoints makes exploitation straightforward. The attack vector requires only a crafted request to a public deserialization endpoint; no user session or elevated privileges are needed. The vulnerability permits reading of arbitrary local files that the application process can access, which can lead to disclosure of configuration, credentials, or other sensitive data. The flaw is not listed in CISA’s KEV catalog and no public exploits have yet been reported.