Exploitable Property Path Vulnerability in Symfony Serializer Component

CVE-2026-122053

What is CVE-2026-122053?

The Symfony Serializer component's ObjectNormalizer is vulnerable to property path exploitation, allowing untrusted input to modify properties of nested objects. Specifically, attributes containing special characters like '.' and '[' can be treated as writable paths, bypassing security controls such as the #[Ignore] metadata attribute. This flaw can lead to unauthorized changes in application data, particularly in situations where applications bind untrusted input to object properties. The vulnerability affects several Symfony versions, as outlined, and necessitates careful input validation to prevent exploitation.

References