CVE-2026-122053

The Symfony Serializer component's ObjectNormalizer is vulnerable to a property-path traversal issue in versions 5.4.41 to 5.4.55 , 6.4.9 to 6.4.49 , 7.0.9 to 7.1.0 , 7.1.2 to 7.4.22 , and 8.x prior to 8.1.11 . The vulnerability arises because ObjectNormalizer treats attribute names containing . ...