Nicolas Grekas

Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control

Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects

Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true

Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File

Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File

Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request

Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process

Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls

Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers

Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass