CVE-2026-122053: 
PHP vulnerability analysis and mitigation

CVE-2026-122053 is a property-path traversal vulnerability in the Symfony Serializer component's ObjectNormalizer that allows untrusted input to modify properties of nested objects and bypass #[Ignore] metadata restrictions. Disclosed on November 4–6, 2026, it affects symfony/serializer versions 5.4.41–5.4.55, 6.4.9–6.4.49, 7.0.9–7.0.x, 7.1.2–7.4.22, and 8.0.0–8.1.10. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). ObjectNormalizer::isAllowedAttribute() previously treated any attribute name containing a . (or [ from Symfony 6.4 onward) as writable without consulting class metadata, passing it directly to PropertyAccessor::setValue(), which parses it as a property path and traverses into nested objects. For example, a payload key customer.admin would write to $order->customer->admin, completely bypassing the #[Ignore] annotation on the nested Customer class. Additionally, because PropertyAccessor resolves path segments against public methods, a crafted segment matching a public method name can invoke that method with an attacker-controlled value. The fix, applied in commits fcaf87a (5.x branch) and 9f73906 (6.4+ branch), restricts property-path acceptance to only those paths explicitly declared in class metadata (GitHub Advisory, Symfony Commit 5.x, Symfony Commit 6.x+).

Successful exploitation allows an unauthenticated remote attacker to write arbitrary values to protected properties of nested objects in a Symfony application, bypassing serialization metadata guards such as #[Ignore]. This can lead to unauthorized privilege escalation (e.g., setting an admin flag to true), data integrity violations, and unintended invocation of public methods with attacker-supplied arguments. Applications using #[MapRequestPayload] or #[MapQueryString] with OBJECT_TO_POPULATE (common in REST APIs and partial-update endpoints) are particularly at risk, as modified fields may be persisted to a database (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as automatable (Feedly). The EPSS score is approximately 0.327%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and no special privileges, making it straightforward to attempt against exposed endpoints (GitHub Advisory).

1. Reconnaissance: Identify Symfony-based web applications exposing endpoints that accept JSON or form-encoded request bodies and bind them to objects using #[MapRequestPayload], #[MapQueryString], or direct ObjectNormalizer::denormalize() calls. Tools like Shodan, Censys, or manual inspection of API documentation can assist.
2. Identify target object graph: Determine the root class being deserialized and identify nested objects with sensitive properties (e.g., admin, role, isVerified) that are annotated with #[Ignore] or otherwise expected to be non-writable from user input.
3. Craft malicious payload: Construct a JSON payload that includes a dotted-key property path targeting the sensitive nested property. For example:

   {"qty": 1, "customer": {"name": "Mallory"}, "customer.admin": true}

4. Submit the payload: Send the crafted request to the vulnerable endpoint via HTTP POST (or GET with query string for #[MapQueryString]), ensuring no serialization groups are specified in the context (as #[Groups] restrictions are not bypassed).
5. Achieve unauthorized modification: The ObjectNormalizer passes customer.admin to PropertyAccessor, which traverses the object graph and sets $order->customer->admin = true, bypassing the #[Ignore] annotation. If the application persists the entity, the change is saved to the database (GitHub Advisory).

• Network: HTTP requests to API endpoints containing JSON keys with dot notation (e.g., "customer.admin", "user.role") or bracket notation (e.g., "values[first]") in the request body; these are abnormal for standard REST payloads.
• Logs: Application or web server access logs showing POST/PUT/PATCH requests with unusually structured JSON bodies containing dotted keys; Symfony application logs recording unexpected property writes or method invocations on nested objects.
• Application Behavior: Unexpected privilege escalation of user accounts (e.g., non-admin users gaining admin status); database records showing modifications to fields that should not be user-writable; audit logs showing changes to sensitive boolean flags (admin, verified, active) without corresponding legitimate user actions.

Upgrade symfony/serializer (or symfony/symfony) to one of the patched versions: 5.4.56, 6.4.50, 7.4.23, or 8.1.11. The fix ensures that property paths (attribute names containing . or [) are only accepted during denormalization when the class metadata explicitly declares an attribute with that exact name; undeclared paths are silently ignored. As a workaround for applications that cannot immediately upgrade, ensure all deserialization endpoints use #[Groups] context restrictions, which prevent the bypass (the path fast-lane is only taken when no groups are passed). Additionally, review all controllers using #[MapRequestPayload] or #[MapQueryString] to confirm that sensitive nested properties are protected by explicit allowlists (GitHub Advisory, Symfony Commit 5.x, Symfony Commit 6.x+).

The vulnerability was reported by Alexandre Daubois and The PHP Foundation, and credited accordingly in the official GitHub Security Advisory. The fix was authored by nicolas-grekas, a core Symfony contributor. No significant broader media coverage or notable social media discussion has been identified beyond the advisory and standard CVE tracking sites (GitHub Advisory).