{"id":"CVE-2026-122053","title":"Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects","summary":"The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their #[Ignore] m…","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-915"],"vendor":"sensiolabs","product":"symfony/serializer","affected":["symfony/serializer >= 5.4.41 < 5.4.56","symfony/serializer >= 6.4.9 < 6.4.50","symfony/serializer >= 7.0.9 < 7.1.0","symfony/serializer >= 7.1.2 < 7.4.23","symfony/serializer >= 8.0.0 < 8.1.11"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-06T20:39:21.488819Z"},"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T20:39:54.876Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-122053","references":[{"url":"https://github.com/symfony/symfony/security/advisories/GHSA-hqp2-7rr8-hf26"},{"url":"https://github.com/symfony/symfony/commit/fcaf87a93c7fa5b7fe9e9e8382d4ed0d0c52c67c"},{"url":"https://github.com/symfony/symfony/commit/9f7390678a255f7962fb1c81c42b26fa907d3437"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T16:57:43.120Z","epss":0.00327,"epssPercentile":0.25961,"slug":"CVE-2026-122053","body":"## Overview\n\nThe Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their #[Ignore] metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11.\nObjectNormalizer::isAllowedAttribute() accepts such names, and setAttributeValue() hands the name straight to PropertyAccessor::setValue(), which parses it as a property path and traverses into the nested object. A payload key such as customer.admin writes to $order->customer->admin. The #[Ignore] metadata attribute is only consulted when the nested object is denormalized in its own right, never when it is reached through a path. #[Groups] restrictions are not bypassed: the path is only accepted when no groups are passed in the context, and then groups restrict nothing. When the root class carries neither #[Ignore] nor #[Groups], no allowlist applies and every key of the payload is let through. Because PropertyAccessor also resolves a path segment against public methods, a segment matching a public method name invokes that method with the attacker’s value.Applications that bind untrusted input to objects are affected, including controllers using #[MapRequestPayload] or #[MapQueryString], whose default normalizer is ObjectNormalizer. With OBJECT_TO_POPULATE, as used for partial updates, the traversal reaches an already hydrated entity graph, and the modified field may be persisted.\n\nThe fix accepts a property path only when the class metadata declares an attribute of that exact name. Declared paths keep working unchanged, and a path in the payload with no matching declaration is ignored.\n\n## Affected\n\n- `symfony/serializer >= 5.4.41 < 5.4.56`\n- `symfony/serializer >= 6.4.9 < 6.4.50`\n- `symfony/serializer >= 7.0.9 < 7.1.0`\n- `symfony/serializer >= 7.1.2 < 7.4.23`\n- `symfony/serializer >= 8.0.0 < 8.1.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}