{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-122053","assignerOrgId":"596c5446-0ce5-4ba2-aa66-48b3b757a647","state":"PUBLISHED","assignerShortName":"Checkmarx","dateReserved":"2026-11-04T16:22:10.624Z","datePublished":"2026-11-06T16:46:46.986Z","dateUpdated":"2026-11-06T20:39:54.876Z"},"containers":{"cna":{"providerMetadata":{"orgId":"596c5446-0ce5-4ba2-aa66-48b3b757a647","shortName":"Checkmarx","dateUpdated":"2026-11-06T16:51:02.357Z"},"title":"Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects","datePublic":"2026-11-06T16:46:00.000Z","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-915","description":"CWE-915 Improperly controlled modification of Dynamically-Determined object attributes","type":"CWE"}]}],"affected":[{"vendor":"sensiolabs","product":"symfony","collectionURL":"https://packagist.org/packages/symfony/serializer","packageName":"symfony/serializer","repo":"https://github.com/symfony/serializer","modules":["Symfony\\Component\\Serializer\\Normalizer\\ObjectNormalizer::isAllowedAttribute()"],"versions":[{"status":"affected","version":"5.4.41","lessThan":"5.4.56","versionType":"git"},{"status":"affected","version":"6.4.9","lessThan":"6.4.50","versionType":"git"},{"status":"affected","version":"7.0.9","lessThan":"7.1.0","versionType":"git"},{"status":"affected","version":"7.1.2","lessThan":"7.4.23","versionType":"git"},{"status":"affected","version":"8.0.0","lessThan":"8.1.11","versionType":"git"}],"defaultStatus":"unaffected"}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.41","versionEndExcluding":"5.4.56"},{"vulnerable":true,"criteria":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.9","versionEndExcluding":"6.4.50"},{"vulnerable":true,"criteria":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.9","versionEndExcluding":"7.1.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1.2","versionEndExcluding":"7.4.23"},{"vulnerable":true,"criteria":"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.1.11"}]}]}],"descriptions":[{"lang":"en","value":"The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their #[Ignore] metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11.\nObjectNormalizer::isAllowedAttribute() accepts such names, and setAttributeValue() hands the name straight to PropertyAccessor::setValue(), which parses it as a property path and traverses into the nested object. A payload key such as customer.admin writes to $order->customer->admin. The #[Ignore] metadata attribute is only consulted when the nested object is denormalized in its own right, never when it is reached through a path. #[Groups] restrictions are not bypassed: the path is only accepted when no groups are passed in the context, and then groups restrict nothing. When the root class carries neither #[Ignore] nor #[Groups], no allowlist applies and every key of the payload is let through. Because PropertyAccessor also resolves a path segment against public methods, a segment matching a public method name invokes that method with the attacker’s value.Applications that bind untrusted input to objects are affected, including controllers using #[MapRequestPayload] or #[MapQueryString], whose default normalizer is ObjectNormalizer. With OBJECT_TO_POPULATE, as used for partial updates, the traversal reaches an already hydrated entity graph, and the modified field may be persisted.\n\nThe fix accepts a property path only when the class metadata declares an attribute of that exact name. Declared paths keep working unchanged, and a path in the payload with no matching declaration is ignored.","supportingMedia":[{"type":"text/html","base64":false,"value":"The Symfony Serializer component&nbsp;<code>ObjectNormalizer</code>&nbsp;treats any attribute name containing&nbsp;<code>.</code>&nbsp;(and, from Symfony 6.4,&nbsp;<code>[</code>) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their&nbsp;<code>#[Ignore]</code> metadata attribute in&nbsp;Symfony versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11.<br><code>ObjectNormalizer::isAllowedAttribute()</code> accepts such names, and <code>setAttributeValue()</code> hands the name straight to <code>PropertyAccessor::setValue()</code>, which parses it as a property path and traverses into the nested object. A payload key such as&nbsp;<code>customer.admin</code>&nbsp;writes to&nbsp;<code>$order-&gt;customer-&gt;admin</code>. The&nbsp;<code>#[Ignore]</code>&nbsp;metadata attribute is only consulted when the nested object is denormalized in its own right, never when it is reached through a path.&nbsp;<code>#[Groups]</code>&nbsp;restrictions are not bypassed: the path is only accepted when no groups are passed in the context, and then groups restrict nothing. When the root class carries neither <code>#[Ignore]</code> nor <code>#[Groups]</code>, no allowlist applies and every key of the payload is let through. Because&nbsp;<code>PropertyAccessor</code> also resolves a path segment against public methods, a segment matching a public method name invokes that method with the attacker’s value.<div>Applications that bind untrusted input to objects are affected, including controllers using <code>#[MapRequestPayload]</code>&nbsp;or&nbsp;<code>#[MapQueryString]</code>, whose default normalizer is <code>ObjectNormalizer</code>. With <code>OBJECT_TO_POPULATE</code>, as used for partial updates, the traversal reaches an already hydrated entity graph, and the modified field may be persisted.</div><div>The fix accepts a property path only when the class metadata declares an attribute of that exact name. Declared paths keep working unchanged, and a path in the payload with no matching declaration is ignored.</div>"}]}],"references":[{"url":"https://github.com/symfony/symfony/security/advisories/GHSA-hqp2-7rr8-hf26","tags":["third-party-advisory"]},{"url":"https://github.com/symfony/symfony/commit/fcaf87a93c7fa5b7fe9e9e8382d4ed0d0c52c67c","tags":["patch"]},{"url":"https://github.com/symfony/symfony/commit/9f7390678a255f7962fb1c81c42b26fa907d3437","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}}],"credits":[{"lang":"en","value":"Alexandre Daubois","type":"reporter"},{"lang":"en","value":"Nicolas Grekas","type":"remediation developer"},{"lang":"en","value":"The PHP Foundation","type":"reporter"}],"source":{"advisory":"GHSA-hqp2-7rr8-hf26","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-11-06T20:39:21.488819Z","id":"CVE-2026-122053","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-11-06T20:39:54.876Z"}}]}}