{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://packagist.org/packages/symfony/serializer","packageName":"symfony/serializer","product":"symfony","source":"CNA: Checkmarx","vendor":"sensiolabs","versions":[{"lessThan":"5.4.56","status":"affected","version":"5.4.41","versionType":"git"},{"lessThan":"6.4.50","status":"affected","version":"6.4.9","versionType":"git"},{"lessThan":"7.1.0","status":"affected","version":"7.0.9","versionType":"git"},{"lessThan":"7.4.23","status":"affected","version":"7.1.2","versionType":"git"},{"lessThan":"8.1.11","status":"affected","version":"8.0.0","versionType":"git"}]}],"cveId":"CVE-2026-122053","cwes":["CWE-915"],"description":"The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their #[Ignore] metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11.\nObjectNormalizer::isAllowedAttribute() accepts such names, and setAttributeValue() hands the name straight to PropertyAccessor::setValue(), which parses it as a property path and traverses into the nested object. A payload key such as customer.admin writes to $order->customer->admin. The #[Ignore] metadata attribute is only consulted when the nested object is denormalized in its own right, never when it is reached through a path. #[Groups] restrictions are not bypassed: the path is only accepted when no groups are passed in the context, and then groups restrict nothing. When the root class carries neither #[Ignore] nor #[Groups], no allowlist applies and every key of the payload is let through. Because PropertyAccessor also resolves a path segment against public methods, a segment matching a public method name invokes that method with the attacker’s value.Applications that bind untrusted input to objects are affected, including controllers using #[MapRequestPayload] or #[MapQueryString], whose default normalizer is ObjectNormalizer. With OBJECT_TO_POPULATE, as used for partial updates, the traversal reaches an already hydrated entity graph, and the modified field may be persisted.\n\nThe fix accepts a property path only when the class metadata declares an attribute of that exact name. Declared paths keep working unchanged, and a path in the payload with no matching declaration is ignored.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: Checkmarx","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":6.5,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},{"score":6.9,"severity":"medium","source":"NVD: 596c5446-0ce5-4ba2-aa66-48b3b757a647","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1793997594876,"publishedAt":1793983606986,"references":[{"source":"CNA: Checkmarx","tags":["third-party-advisory"],"url":"https://github.com/symfony/symfony/security/advisories/GHSA-hqp2-7rr8-hf26"},{"source":"CNA: Checkmarx","tags":["patch"],"url":"https://github.com/symfony/symfony/commit/fcaf87a93c7fa5b7fe9e9e8382d4ed0d0c52c67c"},{"source":"CNA: Checkmarx","tags":["patch"],"url":"https://github.com/symfony/symfony/commit/9f7390678a255f7962fb1c81c42b26fa907d3437"},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","tags":[],"url":"https://github.com/symfony/symfony/commit/9f7390678a255f7962fb1c81c42b26fa907d3437"},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","tags":[],"url":"https://github.com/symfony/symfony/commit/fcaf87a93c7fa5b7fe9e9e8382d4ed0d0c52c67c"},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","tags":[],"url":"https://github.com/symfony/symfony/security/advisories/GHSA-hqp2-7rr8-hf26"}],"remediation":[{"kind":"fix","source":"CNA: Checkmarx","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/symfony/symfony/commit/fcaf87a93c7fa5b7fe9e9e8382d4ed0d0c52c67c"},{"kind":"fix","source":"CNA: Checkmarx","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/symfony/symfony/commit/9f7390678a255f7962fb1c81c42b26fa907d3437"}],"revision":"d1f7673d6514fc2c129c226587f0ddb9e50b646fce57e8f995ad92ada6b82f5c","sources":[{"modifiedAt":1793997594876,"name":"CNA: Checkmarx","retrievedAt":1793999352503,"url":"https://www.cve.org/CVERecord?id=CVE-2026-122053"},{"modifiedAt":1793985440123,"name":"NVD","retrievedAt":1793990235216,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122053"}],"ssvc":{"assessedAt":1793997561488,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects","updatedAt":1793999352503}