CVE-2026-122053

Name of the Vulnerable Software and Affected Versions Symfony versions 5.4.41 through 5.4.55 Symfony versions 6.4.9 through 6.4.49 Symfony versions 7.0.9 through 7.0.9 Symfony versions 7.1.2 through 7.4.22 Symfony versions 8.x through 8.1.10

Description The Symfony Serializer component ObjectNormalizer incorrectly treats attribute names containing . (and [ starting from version 6.4) as writable property paths. This allows untrusted input to modify properties of nested objects, bypassing the #[Ignore] metadata attribute. The issue occurs because ObjectNormalizer::isAllowedAttribute() accepts these names, and setAttributeValue() passes them to PropertyAccessor::setValue(), which parses the name as a path to traverse into nested objects. For example, a payload key like customer.admin can write to $order->customer->admin. Additionally, since PropertyAccessor resolves path segments against public methods, a segment matching a public method name can trigger that method with an attacker-supplied value. This affects applications binding untrusted input to objects, such as controllers using #[MapRequestPayload] or #[MapQueryString]. When using OBJECT TO POPULATE for partial updates, the traversal can reach a hydrated entity graph, potentially leading to the persistence of modified fields.

Recommendations Update Symfony versions 5.4.41 through 5.4.55 to version 5.4.56. Update Symfony versions 6.4.9 through 6.4.49 to version 6.4.50. Update Symfony versions 7.0.9 through 7.0.9 to version 7.1.0. Update Symfony versions 7.1.2 through 7.4.22 to version 7.4.23. Update Symfony versions 8.x through 8.1.10 to version 8.1.11.