Symfony is a PHP framework and a set of reusable PHP components. In affected versions, the Serializer component's DataUriNormalizer recognized only the exact types SplFileInfo, SplFileObject and File, so denormalizing untrusted input into a property typed as a subclass such as UploadedFile was instead handled by the object normalizer, which built the object from the submitted data including its file path. An application that denormalizes untrusted input into such a property could be induced to build a file object referencing an arbitrary file on the server. This issue is fixed in Symfony 5.4.56, 6.4.50, 7.4.23 and 8.1.11.