4 matches found
CVE-2026-122053
The Symfony Serializer component ObjectNormalizer treats any attribute name containing . and, from Symfony 6.4, as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their Ignore metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9...
CVE-2026-122053
The Symfony Serializer component's ObjectNormalizer is vulnerable to a property-path traversal issue in versions 5.4.41 to 5.4.55 , 6.4.9 to 6.4.49 , 7.0.9 to 7.1.0 , 7.1.2 to 7.4.22 , and 8.x prior to 8.1.11 . The vulnerability arises because ObjectNormalizer treats attribute names containing . ...
CVE-2026-122053 Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects
The Symfony Serializer component ObjectNormalizer treats any attribute name containing . and, from Symfony 6.4, as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their Ignore metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9...
EUVD-2026-118360
The Symfony Serializer component ObjectNormalizer treats any attribute name containing . and, from Symfony 6.4, as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their Ignore metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9...