CVE-2026-121623 - Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File
CVE ID :CVE-2026-121623 Published : Nov. 6, 2026, 4:17 p.m. | 52 minutes ago Description :The Symfony Serializer component DataUriNormalizer::denormalize() matches the data: scheme with a case-sensitive regular expression, allowing a value with an uppercase scheme, such as...