CVE-2026-118515: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File

PKSA-grh8-hvfp-h9pf CVE-2026-118515

Affected version: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11

Reported by:
FriendsOfPHP/security-advisories

ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects

PKSA-y18k-qjc6-knrv

Affected version: >=5.4.41,<5.4.56|>=6.4.9,<6.4.50|>=7.0.9,<7.1.0|>=7.1.2,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11

Reported by:
FriendsOfPHP/security-advisories

DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File

PKSA-nyd8-k74r-fsf2

Affected version: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11

Reported by:
FriendsOfPHP/security-advisories

[MEDIUM] CVE-2021-41270: Prevent CSV Injection via formulas

PKSA-s1hc-69wj-fhpp CVE-2021-41270 GHSA-2xhg-w2g5-w95x

Affected version: >=4.1.0,<4.2.0|>=4.2.0,<4.3.0|>=4.3.0,<4.4.0|>=4.4.0,<4.4.35|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.3.12

Reported by:
GitHub, FriendsOfPHP/security-advisories

[CRITICAL] XML decoding attack vector through external entities

PKSA-ft85-yyfg-zynf GHSA-j68w-pg49-f6vx

Affected version: >=2.0.0,<2.0.11

Reported by:
GitHub, FriendsOfPHP/security-advisories